Developer notes

SuperIntelligence is AI by SuperFile. SuperFile is the technology underneath; Sup, SuperDRM, SuperEngine and SuperSecure are the products that talk to it. This page is the contract: what goes over the wire, what comes back, and what you can verify.

Authentication

Send a SuperID access token as Authorization: Bearer …. First-party servers use a service token plus X-Sup-User. The relay binds every session to the SuperID subject it saw; the AAD on your sealed request must be that subject.

Endpoints

Call	Body	Returns
`POST /v1/session`	`{ pub }` — your ECDH P-256 public key, raw, base64url	`{ session, pub, salt, ttl_s }` — single use, five minutes
`POST /v1/ask`	`{ session, iv, ct }` — AES-GCM over `{ question, context?, task?, instructions? }`	`{ iv, ct, receipt }` — `ct` opens to `{ answer, ok, aliases }`
`GET /v1/memory`	—	rows without `ct`
`POST /v1/memory`	`{ kind, source, iv, ct }`	`{ id }`
`DELETE /v1/memory/:id` · `DELETE /v1/memory`	—	erase one · erase all
`GET /.well-known/superintel-keys.json`	—	`{ keys: [{ kid, alg: "Ed25519", pub }] }`

Key derivation

ECDH P-256 shared secret → HKDF-SHA256 with the session salt and info superintel:v1 → AES-256-GCM. The relay zeroes its copy after the answer.

The receipt

{ "v": 1, "id": "…", "ts": "2026-09-16T17:31:02.114Z", "session": "…", "model": "gpt-oss-120b",
  "prompt_sha256": "…", "answer_sha256": "…", "alias_map_sha256": "…", "schema": "superlang/v1", "retention": "none",
  "kid": "…", "sig": "…" }

Verification: drop sig and kid, serialise the remaining fields as JSON with keys sorted, and verify the Ed25519 signature with the key whose kid matches. The verifier on the overview page does exactly this in your browser.

SDK

packages/sdk/superintel.ts — WebCrypto only, no dependencies.

import { ask, verifyReceipt } from "superintel";
const r = await ask(BASE, { bearer: token }, { question, context });
if (!(await verifyReceipt(BASE, r.receipt))) throw new Error("receipt does not verify");

What is live and what is not

Live: ephemeral keys, SuperLang aliasing, Ed25519 receipts, erasable memory.
Building: non-materialised compute, the differential-privacy accountant, zero-knowledge receipts, the personal small model trained on your own files.

Retention field

retention: "none" — the answer ran on hardware we operate; no words kept. "provider" — a frontier model (provider names it) received the aliased prompt under its own terms. "provider-zdr" — that provider has a zero-data-retention agreement with us.

SuperIntelligence is a product of SuperFile Inc. · Privacy · Terms · Legal and API terms · security.txt · GPT is a mark of OpenAI, Claude of Anthropic, PBC, watsonx of IBM.