Overview

​

Quick Start

​

1. Install Your Preferred SDK

pip install tinfoil

​

2. Get Your API Key

Visit the Tinfoil Dashboard to generate your API key.

​

3. Make Your First Request

import os
from tinfoil import TinfoilAI

client = TinfoilAI(
    api_key=os.getenv("TINFOIL_API_KEY"),
    enclave="llama3-3-70b-p.model.tinfoil.sh",
    repo="tinfoilsh/confidential-llama3-3-70b-prod"
)
response = client.chat.completions.create(
    model="llama3-3-70b",
    messages=[{"role": "user", "content": "Explain quantum computing"}]
)
print(response.choices[0].message.content)

​

Available SDKs

​

Choose Your SDK

​

What Are Tinfoil SDKs?

Tinfoil provides SDKs that make it easy to integrate confidential AI inference into your applications. Each SDK is designed to be a drop-in replacement for OpenAI clients while adding powerful security guarantees.

​

Key Benefits

• Automatic Security Verification - Every request verifies you’re connecting to a genuine secure enclave
• Drop-in Compatibility - Replace openai imports with tinfoil - that’s it!

​

How It Works

1. Install any Tinfoil SDK using your language’s package manager
2. Replace your OpenAI import with the Tinfoil equivalent
3. Use the same API you’re already familiar with
4. Get automatic security - attestation verification happens transparently

​

Why Use Tinfoil SDKs?

You have two options for connecting to Tinfoil’s confidential AI inference:

1. Tinfoil Client SDKs (Recommended) - Our SDKs with built-in in-band security verification
2. Direct API Access - Standard POST requests to our endpoints without in-band secure verification

While both approaches work, they offer different security guarantees and user experiences.

​

In-Band vs Out-of-Band Verification

​

Why Certificate Pinning Matters

When you use a Tinfoil client, here’s what happens behind the scenes:

​

1. Initial Attestation Verification

The client performs cryptographic verification that:

• The AI inference server is running in a genuine secure enclave
• The enclave is running the expected code that we published on GitHub and Sigstore
• The TLS certificate for every request corresponds to this verified enclave

​

2. Certificate Pinning Protection

Once verified, the client “pins” the TLS certificate, which means:

• Prevents certificate swapping - Tinfoil cannot issue a new certificate and redirect your traffic
• Maintains connection integrity - All subsequent requests use the same verified connection
• Real-time security - Every request benefits from the initial attestation verification

​

3. What Could Go Wrong Without Pinning

With direct API access, a malicious actor (even Tinfoil itself) could theoretically:

• Issue a new TLS certificate
• Route your traffic to a different (non-enclave) inference server
• Process your data without confidentiality guarantees

​

Security Comparison

​

When to Use Each Approach

​

✅ Use Tinfoil Clients When:

• You want maximum security (recommended for all production use)
• You want to migrate from an existing OpenAI SDK with minimal code changes
• You need real-time security guarantees
• You want to focus on your application logic rather than security implementation

​

⚠️ Consider Direct API Access When:

• You have existing HTTP client infrastructure that’s deeply integrated
• You need custom request/response handling that our SDKs don’t support
• You’re building a proxy or gateway that needs low-level control
• You want to implement your own verification logic for specific compliance requirements

​

Next Steps

1. Browse available models in our Model Catalog
2. Browse examples for your preferred SDK