API
Privatemode proxy app
The Privatemode proxy app is a desktop app for Windows and macOS that runs the client side of Privatemode on your computer. Like the Privatemode proxy docker container, it exposes a local OpenAI- and Anthropic-compatible endpoint, so existing applications can use Privatemode without changes. It:
- Verifies the Privatemode deployment through remote attestation before it sends any data, then encrypts prompts and decrypts responses on your computer.
- Serves Privatemode models under the names an application expects, through model aliases and a model prefix.
The app embeds the Privatemode SDK. It listens on localhost only and shows the attestation result, the proxy state, and request logs in its window and tray icon.
Info
The Privatemode proxy app is in preview. Screens and settings may still change.
Installing the app
Download the latest version for your platform:
- Windows: Download and run Privatemode-Proxy-App-Setup.exe.
- macOS: Download Privatemode-Proxy-App.dmg, open it, and drag the app into the Applications folder.
On first use, macOS asks for your password twice. The first prompt allows the app to store the API key in the keychain. The second one trusts the app's local certificate when the proxy starts for the first time, which the HTTPS endpoint needs.
Starting the proxy
- Open Settings and paste your Privatemode API key into the API key field. The app stores it encrypted in the operating system's credential store and only shows its last four characters.
- On the Status page, select the power button. The status changes to "Verifying backend…" and then to "Verified & serving" when the proxy is ready. The tray icon's menu also starts and stops the proxy.
- Copy the endpoint from the Status page, by default
http://localhost:8080/v1.
The dot on the tray icon shows the state: green while verified and serving, amber while starting or verifying, grey when stopped, and red on errors.
Attestation details
The attestation details on the Status page show what the app verified:
| Field | Meaning |
|---|---|
| Manifest | Fingerprint of the manifest the deployment was verified against |
| Platform | Hardware of the confidential computing environment |
| Measurement | Fingerprint of the software the hardware reported |
| Minimum TCB | Minimum firmware versions the hardware must run |
| Debug access | Must show "Disabled" to confirm the hardware blocks debugging of the running deployment |
View full manifest shows the complete published manifest, and Re-verify repeats the verification. If verification fails, the app stops serving and sends nothing.
Connecting applications
Point an application at the local endpoint:
| Application | Base URL |
|---|---|
| OpenAI-compatible applications and SDKs | http://localhost:8080/v1 |
| Anthropic-compatible applications and SDKs | http://localhost:8080 |
Anthropic-compatible applications often append /v1/messages themselves, so their base URL ends at the port.
Applications don't need an API key. If one requires a key, enter a placeholder: the app ignores keys it receives and always uses the key stored in its settings.
The endpoint serves chat completions with streaming, Anthropic messages, embeddings, audio transcriptions, and the model list. Browser-based applications also need an allowed origin and, on macOS, the HTTPS endpoint.
Model aliases and model prefix
Many applications only accept model names they know, such as fixed Claude model IDs, or only list models whose names follow a pattern. The app serves Privatemode models under such names. Both options are under Settings → Integration and apply immediately, without restarting the proxy.
Model aliases
An alias makes a Privatemode model available under another name:
- Select Add alias.
- Enter the alias exactly as the application sends it.
- Select the Privatemode model it maps to. The list comes from the running proxy. While the proxy is stopped, enter the model name instead.
Applications see the alias at the top of the model list. Prompts sent to the alias go to the selected model, and responses carry the alias name. An alias takes precedence over a real model of the same name.
For example, if an application only offers Claude models, add the alias claude-sonnet-4-5 and select glm-latest. Prompts the application sends to claude-sonnet-4-5 then go to GLM.
See the models overview for the current models.
Model prefix
The app adds a prefix to every real model name. It removes the prefix before forwarding a request and adds it back in the response. Aliases are never prefixed.
For example, the Claude add-ins for Microsoft 365 only list models whose names start with anthropic.. With the prefix anthropic., glm-latest appears there as anthropic.glm-latest.
Settings
| Setting | Section | Description | Default |
|---|---|---|---|
| Port | Local endpoint | Port of the local endpoint | 8080 |
| HTTPS, HTTPS port | Local endpoint | Second endpoint over HTTPS for browser-based applications, see HTTPS endpoint | On for macOS, off for Windows. Port 8443 |
| Mode | Upstream | Embedded: the app verifies and encrypts itself. Forward: the app passes requests to a Privatemode proxy running elsewhere, which verifies and encrypts | Embedded |
| Allowed origin | Integration | Lets one website, such as a browser-based add-in, send prompts through the app under your API key | Off |
| Caching | Prompt caching | Reuses the prompt cache for your own repeated prompts and documents, which speeds them up. A secret cache salt keeps the cache private to this app. Embedded mode only | On |
| Reasoning effort | Reasoning | Default reasoning effort for models that support it, currently GLM, when an application doesn't set it | Model default |
| Startup | Behavior | Starts the proxy when the app launches, and launches the app at login | Start proxy on, launch at login off |
Changing the port, HTTPS, allowed origin, mode, or forward address restarts a running proxy.
HTTPS endpoint
Office on macOS runs add-ins in Safari's engine, which blocks requests from an HTTPS page to plain http://localhost. For such browser-based applications, the app serves a second endpoint at https://localhost:8443/v1. It issues a certificate for localhost, 127.0.0.1, and ::1 only and asks the operating system once to trust it. If you dismissed that prompt, select Trust certificate on the Status page.
Troubleshooting
| Status | Solution |
|---|---|
| No API key | Add your API key in Settings, then start the proxy. |
| Invalid API key | Privatemode rejected the key. Check it in Settings. A paste may have missed characters. |
| Verification failed | The deployment couldn't be verified. Don't send prompts. Try again later or update the app. |
| Privatemode unreachable | Check your internet connection, VPN, or company proxy. |
| Port in use | Another program uses the port. Choose another one in Settings and update your applications. |
| Warning that browsers refuse the HTTPS endpoint | Select Trust certificate and allow the system dialog. |
The Logs tab shows attestation, server, request, and secret events, and Open log file opens the full log. By design, logs only contain metadata such as time, path, status, and duration, never prompts, responses, or keys.
Security
- By design, the app listens on
localhostonly, so other devices on your network can't reach it. - In embedded mode, the app sends nothing to Privatemode before it has verified the deployment, and prompts leave your computer only encrypted. In forward mode, the remote Privatemode proxy performs both.
- The operating system's credential store keeps your API key encrypted, and the app never shows it in full.
- Any program running under your user account can use the local endpoint, and with it your API key. This is the same for every local proxy.