The foundation is the API — but you don’t have to write code to get client-side tokenisation. There are three ways to use CloakAPI, plus a desktop power-up:
API / SDK / proxy (the foundation)
Point your existing OpenAI or Anthropic SDK at the gateway, or run the localhost
local proxy to tokenise PII on your own machine with a
single base_url change. Every call is metered. When a receipt is issued, you can check it against the published JWKS. The release register is an unsigned SHA-256 catalogue, not a signed proof.
→ Quickstart (5 min)
Chat (private front door)
A browser chat window that attempts best-effort on-device tokenisation before relaying to Claude, GPT, Gemini, Grok or DeepSeek. Detection can miss details; review what your client shows before sending — no code, no install. → Get started with Chat
Browser extension
Adds the same privacy layer directly on chatgpt.com, claude.ai,
gemini.google.com and grok.com. Install it from the
Chrome Web Store (works in Chrome and Edge), or load the zip from
Downloads. There is no Edge Add-ons listing; Firefox was withdrawn (HTTP 410).
→ Install the extension
Desktop app (power-up)
A local-tokenisation power-up for Chat — a one-click local proxy, on-device receipt signing and complete-local models. Built from the same tokeniser core as the other surfaces. Windows and Linux builds are on Downloads; macOS coming soon. → Get the desktop app
API, browser extension and desktop app use is key-backed and usage-based. Browser Chat also offers a limited anonymous demo from a shared, capped pool. When the on-device name model is missing, Chat, the extension and the desktop app hold a message while it loads and block it if it fails to load, unless you choose to send with the layers that are ready; the local proxy sends the request with pattern checks only and labels name protection reduced, unless you set it to refuse when the name model is unreachable. Pricing is usage-based, USD only. See pricing.
Token-level privacy
On the client-side ways — browser chat, desktop app, browser extension, and the local proxy — the on-device detector replaces the values it matches before sending (detection is bounded by published recall). The inference gateway checks the caller’s pre-tokenised declaration, request MAC and declared engine identity; it does not scan the message body to confirm that every identifier was replaced. A valid proof authenticates the submitted bytes, not their privacy properties. A request missing required proof can be refused; raw REST callers must tokenise and review content on their own device. Routes to Anthropic, OpenAI, Google Gemini, SpaceXSI Grok, DeepSeek, or self-hosted local (Ollama / LocalAI).
Receipts
When a receipt is issued, it uses a chain-linked OpenReceipt envelope you can check against the published JWKS. The release register is an unsigned SHA-256 catalogue, not a signed proof.
Bring your own keys
Connect your own provider accounts — you pay your provider directly and CloakAPI adds a flat 5% gateway markup for routing, blind relay, and receipts. See pricing.
OIDC provider endpoints
/.well-known/openid-configuration, JWKS and userinfo, so an application
can sign users in with a CloakAPI account. Single sign-on from your own
identity provider (SAML 2.0 or OIDC) and SCIM provisioning are
in development (beta on request).