# Incognito

> Run supported models on Phala's confidential-computing hardware by adding :incognito to the model id.

Deference Incognito is private inference. An Incognito request runs only on Phala's confidential-computing hardware — Intel TDX machines with confidential GPUs, where the model's memory is sealed from the machine's host and operator. The route carries a zero-data-retention policy and never falls back to a provider outside Phala.

It is one suffix on the model id. Your key, base URL, SDK and credit all work unchanged.

## Use it

Append `:incognito` to a supported model id, such as `qwen/qwen3.8-27b:incognito`, and send it as `model` on any endpoint that takes a text model: [Chat Completions](https://deference.si/docs/api-reference/chat-completions), [Messages](https://deference.si/docs/api-reference/messages) or [Responses](https://deference.si/docs/api-reference/responses).

**curl**

```bash
curl https://deference.si/v1/chat/completions \
  -H "Authorization: Bearer $DEFERENCE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "qwen/qwen3.8-27b:incognito",
    "messages": [{ "role": "user", "content": "Say hello in one sentence." }],
    "max_tokens": 100
  }'
```

**Python**

```python
import os
from openai import OpenAI

client = OpenAI(
    base_url="https://deference.si/v1",
    api_key=os.environ["DEFERENCE_API_KEY"],
)

response = client.chat.completions.create(
    model="qwen/qwen3.8-27b:incognito",
    messages=[{"role": "user", "content": "Say hello in one sentence."}],
    max_tokens=100,
)
print(response.choices[0].message.content)
```

**TypeScript**

```typescript
import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://deference.si/v1",
  apiKey: process.env.DEFERENCE_API_KEY,
});

const response = await client.chat.completions.create({
  model: "qwen/qwen3.8-27b:incognito",
  messages: [{ role: "user", content: "Say hello in one sentence." }],
  max_tokens: 100,
});
console.log(response.choices[0].message.content);
```

The Anthropic SDK works the same way — its base URL keeps no `/v1`.

**Python**

```python
import os
import anthropic

client = anthropic.Anthropic(
    base_url="https://deference.si",
    api_key=os.environ["DEFERENCE_API_KEY"],
)

message = client.messages.create(
    model="qwen/qwen3.8-27b:incognito",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Say hello in one sentence."}],
)
print(message.content[0].text)
```

**TypeScript**

```typescript
import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic({
  baseURL: "https://deference.si",
  apiKey: process.env.DEFERENCE_API_KEY,
});

const message = await client.messages.create({
  model: "qwen/qwen3.8-27b:incognito",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Say hello in one sentence." }],
});
console.log(message.content);
```

The response body names the base model, without the suffix: `qwen/qwen3.8-27b`. Billing, [Activity](https://deference.si/activity) and MCP receipts keep the id you sent.

Coding tools such as Claude Code and Codex work with any Incognito model whose `supported_parameters` lists `tools`, since they send tools on every request. The caller identifiers they send are removed before forwarding (see [What Incognito removes](#what-incognito-removes)).

## Models

These are the models Incognito serves at launch. Each runs on one provider: Phala.

| Model id                                    | Input, $/M | Output, $/M | Context   | Max output |
| ------------------------------------------- | ---------- | ----------- | --------- | ---------- |
| `deepseek/deepseek-v4.1-flash:incognito`    | 0.21       | 0.84        | 1,048,576 | 943,718    |
| `z-ai/glm-5.3-flash:incognito`              | 0.1275     | 0.425       | 1,048,576 | 131,072    |
| `z-ai/glm-5.3:incognito`                    | 0.84       | 2.64        | 1,048,576 | 943,718    |
| `deepseek/deepseek-v4-pro-0813:incognito`   | 0.957      | 2.8776      | 1,048,576 | 393,216    |
| `deepseek/deepseek-v4-flash-0731:incognito` | 0.308      | 0.924       | 1,048,576 | 393,216    |
| `moonshotai/kimi-k3:incognito`              | 2.55       | 12.75       | 1,048,576 | 943,718    |
| `z-ai/glm-5.2:incognito`                    | 1.26       | 3.00        | 1,048,576 | 131,072    |
| `qwen/qwen3.8-27b:incognito`                | 0.20       | 2.50        | 1,000,000 | 262,144    |
| `tencent/hy3:incognito`                     | 0.15       | 0.64        | 262,144   | 235,929    |
| `moonshotai/kimi-k2.7-code:incognito`       | 0.95       | 4.00        | 262,144   | 235,929    |
| `qwen/qwen3.6-35b-a3b:incognito`            | 0.20       | 1.27        | 262,144   | 235,929    |
| `qwen/qwen3.6-27b:incognito`                | 0.32       | 3.25        | 262,144   | 262,140    |
| `moonshotai/kimi-k2.6:incognito`            | 1.09       | 4.60        | 262,144   | 235,929    |
| `z-ai/glm-5.1:incognito`                    | 1.21       | 4.20        | 202,752   | 128,000    |
| `qwen/qwen3.5-27b:incognito`                | 0.30       | 2.40        | 262,144   | 65,536     |
| `qwen/qwen3.5-397b-a17b:incognito`          | 0.55       | 3.50        | 262,144   | 235,929    |
| `deepseek/deepseek-v3.2:incognito`          | 1.00       | 1.00        | 163,840   | 64,000     |
| `openai/gpt-oss-120b:incognito`             | 0.15       | 0.60        | 131,072   | 32,768     |
| `qwen/qwen-2.5-7b-instruct:incognito`       | 0.10       | 0.20        | 32,768    | 29,491     |

Prices are Phala's prices per million tokens, before the 5% routing fee. [Models](https://deference.si/models?mode=incognito) and `GET /v1/models` show the prices you pay, fee included.

Each Incognito model in `GET /v1/models` carries `"incognito": { "provider": "Phala", "zdr": true, "verification": "provider_reported" }`, and its `display_name` ends in ` · Incognito`.

A model's capabilities follow its Phala endpoint, which can differ from the same model's other providers. Check `supported_parameters` on `GET /v1/models/{id}` before you rely on tools, structured outputs or reasoning. A request that sends a parameter the Phala endpoint does not list fails instead of running without it, with `404 upstream_404` ("The model provider rejected the request"), and nothing is charged.

## Pricing and holds

An Incognito call costs Phala's price plus a 5% routing fee. Deference adds no markup.

The hold works as on every request — an estimated cost is reserved, then the measured cost is charged — but because the route cannot fall back to a pricier provider, the estimate uses the Phala endpoint's own prices. The hold on an Incognito call can be smaller than the same model's standard hold. See [Pricing](https://deference.si/docs/concepts/pricing-and-metering).

Incognito needs credit. [Free credit](https://deference.si/docs/concepts/free-credit) never pays for it: an account with only free credit gets `402 free_credit_not_eligible`.

## What Incognito removes

Incognito removes these caller identifiers from the request before forwarding it: `user`, `session_id`, `sessionId`, `safety_identifier`, `prompt_cache_key`, `metadata` and `trace`. The request still runs. This covers the `metadata.user_id` Claude Code sends on every Messages request and the `prompt_cache_key` Codex can send on Responses.

## What an Incognito request refuses

Fields that would leave Phala's hardware, keep state, or change the route are refused before the request runs. Nothing is held or charged.

| You send                                                                                      | Result                                                                                                 |
| --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| `provider`, `models`, `fallbacks` or `route`                                                  | `400 unsupported_parameter`, as on every request                                                       |
| `plugins`, `web_search_options`, `mcp_servers` or `container`                                 | `400 unsupported_parameter`. These run outside Phala's confidential hardware.                          |
| Server tools such as web search                                                               | `400 unsupported_parameter`: "Server tools such as web search are not available with Incognito models" |
| A file part                                                                                   | `400 unsupported_parameter`: "Files are not available with Incognito models". Send text or images.     |
| `previous_response_id`, `conversation`, `prompt`, `background`, or `store` other than `false` | `400 unsupported_parameter`: "Incognito keeps no stored conversation state"                            |
| `speed`, or a `service_tier` other than `default` or `standard`                               | `400 unsupported_parameter`: "Incognito runs on the standard tier only"                                |
| Any endpoint other than Chat Completions, Messages or Responses                               | `400 unsupported_endpoint`                                                                             |
| `:incognito` combined with another suffix, like `:free:incognito`                             | `404 model_not_found`                                                                                  |

A base model id that has no Incognito row also returns `404 model_not_found`. A missing or stale Phala route fails the request rather than serve it elsewhere.

Function tools you define yourself still work where the model's endpoint supports them: the model proposes the call and your code runs it, in your own environment.

The [MCP server](https://deference.si/docs/coding-tools/mcp) accepts Incognito ids on `deference_run_model` and refuses its `web_search` option on them with `invalid_input`. Its receipt keeps the `:incognito` id, its `provider` reads `"Phala"`, and its `verification` reads `"provider_reported"` (it is `null` on other models). See [MCP tools](https://deference.si/docs/coding-tools/mcp-tools).

## What Deference stores

Deference keeps the billing record — key, model, provider, tokens, cost and times — so the charge can be reconciled and shown in Activity. Prompt and response text are never stored; the request's **Content** reads **Not stored**, as on every text call.

On an Incognito request the client and session are not recorded, and no account tag or caller identifier is sent upstream.

Incognito is not anonymous: the record stays tied to your account and key, and INFERENCE activity on chain is outside the inference path entirely.

## Check what served a call

Open the request in [Activity](https://deference.si/activity). **Mode** reads **Incognito · provider reported**, and **Provider** reads **Phala**, the provider the routing layer reported for that call. On a Responses call the provider appears once the request settles. Once the charge settles, the price reads **Phala's price** and **Routing fee**.

For evidence about the hardware itself, Phala publishes a live attestation for each model's current sessions:

```text
https://inference.phala.com/v1/aci/sessions?model=<model-id>
```

Substitute the base model id, for example `https://inference.phala.com/v1/aci/sessions?model=qwen/qwen-2.5-7b-instruct`. The record describes the attested environment serving that model. It is evidence about the hardware, not a receipt for your specific call.

## What Incognito does not do

Incognito routes supported models to Phala and only to Phala, under a zero-data-retention policy, with no fallback to another provider. The confidential-computing hardware is designed to keep the machine's host and operator from reading the memory the model runs in.

Within that boundary, read the limits plainly:

* Your prompt is ordinary text to Deference and to the routing layer that forwards it — both process it to deliver the response. The software inside Phala's protected workload can read it too. Incognito is not end-to-end encrypted.
* Zero data retention is the providers' retention policy for the route, not a proof that every copy is erased.
* Deference keeps billing records, tied to your account and key. No prompt or response text is stored.
* The provider attribution in Activity is reported by the routing layer. There is no per-request cryptographic receipt through this route today, and model weights are not verified by it.
* A tool your agent runs, and anything the MCP host sees, stays outside the enclave.
* Phala-only routing trades resilience for privacy: when the route cannot serve a model, the request fails rather than fall back.