# Flashpaper — Self-Destructing Encrypted Notes & Files for Humans & AI Agents

> Flashpaper is an ephemeral confidential secret-sharing infrastructure. Client-side browser flows offer true zero-knowledge end-to-end encryption. Agent API flows offer server-side ephemeral encryption with RAM-only storage and zero disk persistence.

## Agent Endpoints & Tool Specifications
- Agent Secret Creation Endpoint: POST /api/agent/vault
  Headers: Optional X-Api-Key: <key> for higher creation rate limit quotas.
  Payload: { "secretText": "<API_KEY_OR_CREDENTIAL>", "burnTrigger": "1_view", "agentName": "Cursor AI Assistant", "agentPurpose": "Database Provisioning", "webhookUrl": "https://agent.example.com/webhooks/pickup" }
  Response: { "secretUrl": "https://flashpaper.app/secret/UUID#DECRYPTION_KEY", "vaultId": "UUID", "key": "DECRYPTION_KEY", "destroyToken": "TOKEN", "encryptionMode": "server-side-ephemeral" }
- Agent-to-Agent Claim Endpoint: POST /api/agent/vault/:id/claim
  CRITICAL: Agents must use POST /api/agent/vault/:id/claim to retrieve secret payloads — never fetch the /secret/<id> HTML page directly.
  Payload: { "key": "<base64url_decryption_key>" }
  Response: { "secretText": "<PLAINTEXT>", "agentName": "...", "agentPurpose": "...", "remainingViews": 0, "burned": true, "encryptionMode": "server-side-ephemeral" }
  Note: If the key is invalid, returns 403 without burning or incrementing view count. If already burned/expired, returns 404 (interception signal).
- Agent System Health Endpoint: GET /api/agent/health
  Response: { "status": "healthy", "activeSecretsInRAM": 42, "encryptionMode": "server-side-ephemeral" }
- Model Context Protocol (MCP) Server: POST /api/mcp (JSON-RPC 2.0) and GET /mcp.json
  Supports tools "create_secret_burn_link", "claim_secret", "check_secret_status", and "burn_secret_immediately" natively in Cursor & Claude Desktop.
- OpenAPI 3.0 Specification: GET /openapi.json
  Import directly into OpenAI Custom GPT Actions, Zapier, n8n, and LangChain OpenAPI Toolkit.

## Core Capabilities
- Verified Agent Issuer Metadata Tagging: AI Agents tag secret payloads with agentName and agentPurpose. Recipients view a prominent "Verified Agent Issuer" badge upon decryption.
- Client-Side & Ephemeral RAM AES-256-GCM Encryption: Browser flows offer client-side zero-knowledge encryption. Agent flows encrypt ephemerally in server RAM with zero disk persistence.
- 100% Database-Free (RAM Only): Volatile memory buffers undergo best-effort zeroing upon reading or expiration. No persistent magnetic disk writes occur.
- Agent Health & Circuit Breaker Diagnostics: GET /api/agent/health provides real-time active secret counts and memory usage.
- Spotlight Lens Anti-Screenshot Protection: Dynamic optical spotlight blurring prevents full-screen screenshots, OCR grabbers, and shoulder-surfing.
- Flexible Link Limits: Burn options include 1 View (Burn After Reading), 5 Views, 10 Views, 1 Hour, 12 Hours, or 24 Hours max.
- On-Screen Auto-Destruct Timer: Configurable countdown timers (15s, 30s, 60s, 120s, 300s) that wipe secrets from DOM and browser memory.
- White-Label Agency Portals: Custom white-label portals with custom CNAME domains, custom branding, and custom color themes.

## Key URLs
- Main Application: https://flashpaper.app/
- Developer & Agent Infrastructure Docs: https://flashpaper.app/developers
- Agent System Health: https://flashpaper.app/api/agent/health
- OpenAPI Specification: https://flashpaper.app/openapi.json
- MCP Tool Manifest: https://flashpaper.app/mcp.json
- Agency Portal Directory: https://flashpaper.app/portal
- Sitemap: https://flashpaper.app/sitemap.xml

## Security Model
- Client-Side Zero-Knowledge Cryptography (Browser UI)
- Server-Side Ephemeral Encryption (Agent API & MCP)
- 100% Database-Free (RAM Memory Map Only)
- Anti-Crawler & Anti-Bot Shielding
- Automatic 24-Hour Max Memory Purge