--- title: ScaiClip order: '1' summary: "End-to-end encrypted, multi-device shared clipboard \u2014 text, files,\ \ secrets \u2014 with server-side scratch storage, WeTransfer-style public links,\ \ and clean integrations for voice assistants and remote terminals." path: index status: published --- ScaiClip is a ScaiGrid module that gives your users a **shared clipboard across every device they own** — with hard end-to-end encryption, expiring one-shot secrets, server-side scratch storage for large files, and public share links for anything they want to hand off outside their team. You get a clipboard that follows the user across their laptop, phone, terminal session, voice assistant, and hosted editor. The server never sees plaintext. The user controls what gets shared, with whom, and for how long. ## When to use it - You ship a client app and want copy/paste to Just Work across your customer's devices. - You want your users to send big files without email attachments or a third-party service. - You want your voice assistant, remote-terminal service, or hosted editor to reach into the user's clipboard — under a consent grant, on a per-session basis, without ever seeing the crypto keys. - You want a self-hosted alternative to WeTransfer that's encrypted, quota-metered, and audited. ## What you get - **End-to-end encryption.** ChaCha20-Poly1305 for content, HPKE (RFC 9180) for key exchange. The server holds ciphertext and opaque wraps only. Blind coordinator posture. - **Multi-device by design.** Personal channels sync clips across every device a user enrolls. Directed channels give a user a private 1:1 clipboard with a peer. - **One-shot clips.** Mark a clip as `ONE_SHOT` — the first device to claim it decrypts, everyone else gets `E_ALREADY_CLAIMED`, and the ciphertext is crypto-shredded. Right primitive for credentials, PINs, MFA codes. - **Sensitive clips.** `SENSITIVE` clips auto-expire in seconds (default 90s), never touch cache, never index into search. - **Scratch storage.** Per-tenant S3-backed store for content that outlives the origin device. Quota-metered per user and per tenant. - **Two sharing modes for files.** `ref_origin` streams from the source client on demand (grid proxies + caches). `ref_scratch` stores centrally so the origin can log off. Users pick per-item; sensible defaults by size. - **Public share links.** Mint a link for any scratch object. AEAD key rides in the URL fragment — the server never sees plaintext. Optional password (Argon2id), download limits, revoke on demand. - **Server-side integrations.** ScaiWave (voice), ScaiTerm (remote terminal), ScaiDrive-server (hosted docs), ScaiEdit-server (hosted editor) get bounded, per-session, user-consented clipboard access via SCSG (Service Consumer Session Grant). - **Full audit trail.** Every channel create, clip publish, claim, wrap install, public download, and consent grant lands in `audit_log`. Query it via the standard ScaiGrid audit APIs. - **ScaiGrid-native.** Runs as a module inside your existing ScaiGrid. Uses the same auth (ScaiKey), same accounting, same tenancy, same admin UI extension model. ## Anatomy of a session A user opens their laptop and enrols it into their personal channel. The client generates an X25519 KEM key + Ed25519 signing key; the private keys never leave the device. ScaiKey knows the pubkeys. The user copies text on their phone. The phone encrypts with a fresh content key, wraps the content key for every enrolled device, signs the envelope, and publishes to ScaiGrid. The grid appends to the phone's personal-channel log, fans out `clip.new` to the laptop. The laptop receives, verifies the signature, unwraps the content key with its own private key, decrypts, hits the OS clipboard. Total latency: <250 ms warm. A voice assistant on ScaiWave joins the user's next call. It opens an SCSG session — a request for bounded clipboard access, "read + write, until the call hangs up." The user's laptop shows a consent prompt: *"ScaiWave wants your clipboard for this call. Allow?"* The user allows; the laptop wraps the channel key for ScaiWave's ephemeral pubkey. Now ScaiWave can read what the user copied and paste responses back — for the duration of that call, no longer. The user drops a 200 MB video into the shared clipboard. Client picks `ref_scratch` (over the size threshold). Encrypts, uploads to Garage via a signed URL, publishes the envelope with a `MediaRef` pointer. The user's collaborator on a directed channel pulls the video down — decrypts client-side. The user wants to send that video to a customer outside the platform. Client hits `POST /scratch/{id}/publish`. Gets a `/p/#` URL back. Sends the URL. The customer's browser fetches the ciphertext by token, derives the key from the fragment, decrypts, saves. Server never saw plaintext. ## When *not* to use it - If you need a shared workspace with collaborative editing, that's ScaiEdit, not ScaiClip. - If you need durable object storage as a primary product, that's ScaiDrive. - If you need messaging or streams, that's ScaiMatrix. ScaiClip is the copy/paste primitive — small, sharp, per-user, with a scratch tier for the "I need this on the other machine" case that grows big enough to need central storage. ## What's next - [Quickstart](./quickstart.md) — enrol two devices, send a clip, receive it. Five minutes. - [Core concepts](./concepts/channels.md) — the mental model: channels, envelopes, wraps, claims. - [Encryption & consent](./concepts/encryption.md) — what the server sees, what it doesn't, and how the crypto is put together. - [Server-side integrations](./concepts/service-consumers.md) — SCSG for ScaiWave / ScaiTerm / ScaiDrive-server / ScaiEdit-server. - [Scratch storage & public links](./concepts/scratch-and-public-sharing.md) — the WeTransfer-competitive layer. - [SCWP reference](./reference/scwp.md) — every wire verb, every error code.