Choose your integration

Five ways to build on CloakAPI. Every one reaches the same gateway at api.cloakapi.io with a cloak_ key, and every one tokenises client-side, before egress — there is no server-side tokenise mode (see Build on CloakAPI for the assurance model).

The gateway lock (and why it’s a feature)

The client-side build-surfaces — the drop-in proxy, the SDKs, the self-hosted MCP — are gateway-locked: their base URL must be a CloakAPI gateway host. There is no “point it at any provider” setting.

Frame this positively to your users: your calls always go through the metered gateway. That’s exactly what makes the privacy relay, the signed receipt on every call, and the billing all guaranteed rather than optional. A build that could quietly bypass the gateway could quietly bypass the receipt.

Every surface is billed the same honest way: a markup on the upstream model I/O, in USD only, no tiers or seats. Pooled keys are 15%; BYOK is 5%. Anthropic, OpenAI, Google Gemini, xAI Grok, and DeepSeek are available both pooled (15%) and BYOK (5%); OpenRouter, Perplexity, Mistral, Cohere, Groq, Together AI, and Fireworks AI are BYOK-only (5%). Full detail: Builder pricing.

Pick one

Integration	Best when you…	Tokenisation
Drop-in proxy	already have OpenAI/Anthropic code and want client-side PII with a one-line `base_url` change	Client-side
SDK (8 langs)	want native calls + client-side tokeniser embedded in your language	Client-side
Self-hosted MCP	build agents / connect Claude Desktop, Cursor, or any MCP host	Client-side
Starter-kit	want a whole private-AI chat app to fork, reskin, and ship	Client-side
REST	build in a language without an SDK, or want raw HTTP control	Client-side (tokenise on-device, relay tokens)

Drop-in proxy — `cloak-proxy`

Run the localhost proxy; point any OpenAI/Anthropic client at it. It tokenises on your machine, then forwards only tokens through the gateway. Gateway-locked by design (no provider-URL setting), so every call gets a signed receipt.

from openai import OpenAI

client = OpenAI(
    base_url="http://localhost:8799/v1",
    api_key="unused",  # the proxy holds your CloakAPI key; provider keys live in your account
)

resp = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Summarise the email from Alice."}],
)
print(resp.choices[0].message.content)

Full setup, coverage, and honest limits: Local proxy.

SDK — 8 languages

The canonical SDKs (TypeScript, Python, Go, Java, Rust, PHP, Ruby, .NET) embed the client-side tokeniser (Level-1) and reach the full REST capability set. All are gateway-locked.

# pip install -e sdk/python   (Python wheel not currently served; see /platform/sdks/)
from cloakapi import CloakAPI

client = CloakAPI(api_key="cloak_…")          # base URL is a CloakAPI gateway host
resp = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Summarise the email from Alice."}],
)
print(resp.choices[0].message.content)

Self-hosted MCP — `@cloakapi/mcp-server`

A distributable Model Context Protocol server exposing CloakAPI as ~22 tools (tokenise, detokenise, detect_pii, tokenise_file, tokenise_image, private_completion, private_messages, list_models, count_tokens, verify_receipt, get_receipt, countersign_receipt, list_receipts, receipt_chain_export, chain_verify, transparency_inclusion, get_balance, usage_summary, key_scopes, meter, reconstruct, engine_info). Tokenisation runs inside the MCP component the user runs, so raw PII never egresses — client-side, like every other integration. These names (tokenise, detokenise, detect_pii, reconstruct, …) are client-side tool names, not server endpoints: CloakAPI exposes no /v1/tokenize, /v1/detect, /v1/detokenize, or /v1/reconstruct server route (those are retired). Every tool here executes on-device.

Need the CLOAKAPI_API_KEY below? Get one headless, no browser:

curl -sS -X POST https://api.cloakapi.io/api/v1/self-service/key \
  -H 'Content-Type: application/json' -d '{}'
# → {"api_key":"cloak_…","tier":"free", …}

On-device MCP tools (tokenise, detect_pii, …) work immediately with a free-tier key; key-gated tools that relay (private_completion, get_balance) need a wallet balance. Details + guard rails: Authentication → Get an API key (headless / no browser).

Wire it into any MCP host — e.g. claude_desktop_config.json:

{
  "mcpServers": {
    "cloakapi": {
      "command": "npx",
      "args": ["-y", "@cloakapi/mcp-server"],
      "env": {
        "CLOAKAPI_API_KEY": "cloak_live_…",
        "CLOAKAPI_PRETOKENISED_KEY": "…"
      }
    }
  }
}

Or run it as a streamable-HTTP endpoint (--http, default 127.0.0.1:9473, JSON-RPC at POST /mcp) for an HTTP-capable MCP client.

Starter-kit — fork, reskin, ship

An open, Apache-2.0 reference private-AI chat app. The hard 80% is pre-wired: client-side tokenisation before egress (WASM structured engine + on-device NER for names), fail-closed composer, gateway relay with your key kept server-side, client-side detokenisation across streaming, signed receipts + a “verify this answer” widget, and engine-provenance headers for the gateway version-gate. One-file reskin (src/lib/brand.config.ts — name, logo, colours, tagline, default model + tier). Ships with a neutral placeholder brand so the white-label seams are obvious.

It is intended to be distributed as a self-contained download (like the SDKs — no git remote, no npm account): a tarball vendoring the WASM engine, @cloakapi/open-receipt, @cloakapi/pii-patterns and the TypeScript SDK, so npm install works offline.

The kit also ships examples/roundtrip.mjs — a headless @cloakapi/sdk tokenise → relay → detokenise round-trip plus a signed-receipt verify.

REST — raw HTTP

If your language has no SDK, call the gateway directly. Endpoints include /v1/chat/completions, /v1/messages, /v1/embeddings, /v1/engine/*, and the receipts endpoints (/v1/receipts/verify, /v1/receipts/countersign, …). The gateway is a blind relay: there are no server-side tokenize / detect / detokenize / reconstruct endpoints, because tokenisation (and its reverse) happen only on the client.

curl https://api.cloakapi.io/api/v1/chat/completions \
  -H "Authorization: Bearer cloak_…" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o","messages":[{"role":"user","content":"Hello"}]}'

Client-side note. Over raw REST you tokenise on the end-user’s device first (embed a client-side tokeniser, e.g. the WASM engine or an SDK) and relay only tokens. There is no server-side tokenise endpoint — the gateway never accepts raw text to tokenise for you, so a bare request with un-tokenised PII is relayed as-is (fail-open on that request), never tokenised on our servers. See the assurance model.

Full request/response contracts: the API reference and the Reference section.