Skip to main content

​
Browser access

Open SuperformOS, complete its wallet/account sign-in and any required terms, then select the vault. The application resolves your assigned role; connecting a wallet alone does not grant management permission. The browser uses same-origin backend-for-frontend (BFF) routes. The server checks the session and vault role and forwards upstream authentication; you do not supply a copied browser token. An upstream failure is not automatically an expired browser session. Reconnect when the application requires it; investigate permission and service errors separately.
Do not export cookies, extract browser tokens, copy service credentials, or use a wallet private key as an API key. There is no generic signature-to-JWT automation recipe in this guide.

​
Public reads

Anonymous Strategy GET access is limited to allowlisted routes for verified public vaults. Vault-scoped intent search, intent detail, and fills can be read without signing in; events, simulations, arbitrary engine state, and writes are not covered by that permission. Use the executable public intent example. Unknown query keys or insufficiently scoped filters can be rejected. Do not infer that every GET is public.

​
Approved automation

For authenticated automation, obtain the supported endpoint, identity mechanism, vault role scope, credential lifecycle, and rate policy from the Superform team. Upstream service credentials are infrastructure credentials, not self-service curator keys. Keep automation read-only until its identity and permissions have been agreed and tested in a separately authorized environment. Successful browser login does not establish support for a headless writer.