Incognito

Deference Incognito is private inference. An Incognito request runs only on Phala's confidential-computing hardware — Intel TDX machines with confidential GPUs, where the model's memory is sealed from the machine's host and operator. The route carries a zero-data-retention policy and never falls back to a provider outside Phala.

It is one suffix on the model id. Your key, base URL, SDK and credit all work unchanged.

Use it

Append :incognito to a supported model id, such as qwen/qwen3.8-27b:incognito, and send it as model on any endpoint that takes a text model: Chat Completions, Messages or Responses.

curl https://deference.si/v1/chat/completions \
  -H "Authorization: Bearer $DEFERENCE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "qwen/qwen3.8-27b:incognito",
    "messages": [{ "role": "user", "content": "Say hello in one sentence." }],
    "max_tokens": 100
  }'

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://deference.si/v1",
    api_key=os.environ["DEFERENCE_API_KEY"],
)

response = client.chat.completions.create(
    model="qwen/qwen3.8-27b:incognito",
    messages=[{"role": "user", "content": "Say hello in one sentence."}],
    max_tokens=100,
)
print(response.choices[0].message.content)

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://deference.si/v1",
  apiKey: process.env.DEFERENCE_API_KEY,
});

const response = await client.chat.completions.create({
  model: "qwen/qwen3.8-27b:incognito",
  messages: [{ role: "user", content: "Say hello in one sentence." }],
  max_tokens: 100,
});
console.log(response.choices[0].message.content);

The Anthropic SDK works the same way — its base URL keeps no /v1.

import os
import anthropic

client = anthropic.Anthropic(
    base_url="https://deference.si",
    api_key=os.environ["DEFERENCE_API_KEY"],
)

message = client.messages.create(
    model="qwen/qwen3.8-27b:incognito",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Say hello in one sentence."}],
)
print(message.content[0].text)

import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic({
  baseURL: "https://deference.si",
  apiKey: process.env.DEFERENCE_API_KEY,
});

const message = await client.messages.create({
  model: "qwen/qwen3.8-27b:incognito",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Say hello in one sentence." }],
});
console.log(message.content);

The response body names the base model, without the suffix: qwen/qwen3.8-27b. Billing, Activity and MCP receipts keep the id you sent.

Coding tools such as Claude Code and Codex work with any Incognito model whose supported_parameters lists tools, since they send tools on every request. The caller identifiers they send are removed before forwarding (see What Incognito removes).

Models

These are the models Incognito serves at launch. Each runs on one provider: Phala.

Prices are Phala's prices per million tokens, before the 5% routing fee. Models and GET /v1/models show the prices you pay, fee included.

Each Incognito model in GET /v1/models carries "incognito": { "provider": "Phala", "zdr": true, "verification": "provider_reported" }, and its display_name ends in · Incognito.

A model's capabilities follow its Phala endpoint, which can differ from the same model's other providers. Check supported_parameters on GET /v1/models/{id} before you rely on tools, structured outputs or reasoning. A request that sends a parameter the Phala endpoint does not list fails instead of running without it, with 404 upstream_404 ("The model provider rejected the request"), and nothing is charged.

Pricing and holds

An Incognito call costs Phala's price plus a 5% routing fee. Deference adds no markup.

The hold works as on every request — an estimated cost is reserved, then the measured cost is charged — but because the route cannot fall back to a pricier provider, the estimate uses the Phala endpoint's own prices. The hold on an Incognito call can be smaller than the same model's standard hold. See Pricing.

Incognito needs credit. Free credit never pays for it: an account with only free credit gets 402 free_credit_not_eligible.

What Incognito removes

Incognito removes these caller identifiers from the request before forwarding it: user, session_id, sessionId, safety_identifier, prompt_cache_key, metadata and trace. The request still runs. This covers the metadata.user_id Claude Code sends on every Messages request and the prompt_cache_key Codex can send on Responses.

What an Incognito request refuses

Fields that would leave Phala's hardware, keep state, or change the route are refused before the request runs. Nothing is held or charged.

A base model id that has no Incognito row also returns 404 model_not_found. A missing or stale Phala route fails the request rather than serve it elsewhere.

Function tools you define yourself still work where the model's endpoint supports them: the model proposes the call and your code runs it, in your own environment.

The MCP server accepts Incognito ids on deference_run_model and refuses its web_search option on them with invalid_input. Its receipt keeps the :incognito id, its provider reads "Phala", and its verification reads "provider_reported" (it is null on other models). See MCP tools.

What Deference stores

Deference keeps the billing record — key, model, provider, tokens, cost and times — so the charge can be reconciled and shown in Activity. Prompt and response text are never stored; the request's Content reads Not stored, as on every text call.

On an Incognito request the client and session are not recorded, and no account tag or caller identifier is sent upstream.

Incognito is not anonymous: the record stays tied to your account and key, and INFERENCE activity on chain is outside the inference path entirely.

Check what served a call

Open the request in Activity. Mode reads Incognito · provider reported, and Provider reads Phala, the provider the routing layer reported for that call. On a Responses call the provider appears once the request settles. Once the charge settles, the price reads Phala's price and Routing fee.

For evidence about the hardware itself, Phala publishes a live attestation for each model's current sessions:

https://inference.phala.com/v1/aci/sessions?model=<model-id>

Substitute the base model id, for example https://inference.phala.com/v1/aci/sessions?model=qwen/qwen-2.5-7b-instruct. The record describes the attested environment serving that model. It is evidence about the hardware, not a receipt for your specific call.

What Incognito does not do

Incognito routes supported models to Phala and only to Phala, under a zero-data-retention policy, with no fallback to another provider. The confidential-computing hardware is designed to keep the machine's host and operator from reading the memory the model runs in.

Within that boundary, read the limits plainly:

• Your prompt is ordinary text to Deference and to the routing layer that forwards it — both process it to deliver the response. The software inside Phala's protected workload can read it too. Incognito is not end-to-end encrypted.
• Zero data retention is the providers' retention policy for the route, not a proof that every copy is erased.
• Deference keeps billing records, tied to your account and key. No prompt or response text is stored.
• The provider attribution in Activity is reported by the routing layer. There is no per-request cryptographic receipt through this route today, and model weights are not verified by it.
• A tool your agent runs, and anything the MCP host sees, stays outside the enclave.
• Phala-only routing trades resilience for privacy: when the route cannot serve a model, the request fails rather than fall back.