Pastebin API documentation

Create anonymous pastes with delete tokens, or use a scoped account token to manage private pastes, folders, metadata, and revisions.

Published August 3, 2026 · Last updated August 3, 2026 · By Pastebin.ai Editorial Team

Pastebin API at a glance

Create

Send one JSON request: create a paste with content, title, language, visibility, retention, and optional protection settings.

Manage

Use a scoped account token: list owned pastes, update metadata or content, read revisions, and delete items you control.

Protect

Treat tokens as secrets: store them outside source code, send them only over HTTPS, and revoke unused credentials. Read the API token security guide.

Version and machine-readable contract

The current stable contract is API v1. Endpoint paths under /api/v1/ retain their documented request and response meanings within this major version. Download the OpenAPI 3.1 JSON document for operation IDs, security schemes, request fields, response models, and status codes.

Changelog

August 3, 2026 - V1.0.0: Documented anonymous creation, eligible retrieval, delete-token removal, and bearer-authenticated owned-paste management.

Endpoint map

Use this short table to choose the smallest endpoint and permission set for the task. The command-line paste workflow shows how to wrap these calls in a safer local script.

Task	Method and path	Access
Create an anonymous paste	`POST /api/v1/pastes`	No token
Read an available paste	`GET /api/v1/pastes/{id}`	No token
List owned pastes	`GET /api/v1/account/pastes`	Bearer token with read scope
Update an owned paste	`PATCH /api/v1/account/pastes/{id}`	Bearer token with write scope
Delete an owned paste	`DELETE /api/v1/account/pastes/{id}`	Bearer token with delete scope

Create a paste

POST /api/v1/pastes

Send JSON with a required content string. Optional fields: title, language, visibility, expiration, max_views, category, tags, folder_id, password, encrypted, and burn_after_read. Set max_views from 1 to 1,000 to end access after that many counted unique views.

curl -X POST https://pastebin.ai/api/v1/pastes \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Deployment output",
    "content": "Build completed in 18.4s",
    "language": "plaintext",
    "visibility": "unlisted",
    "expiration": "1d",
    "max_views": 25,
    "category": "logs",
    "tags": "deploy,production"
  }'

Anonymous create response

{
  "id": "aB3xK9mQ2",
  "url": "https://pastebin.ai/p/aB3xK9mQ2",
  "raw_url": "https://pastebin.ai/raw/aB3xK9mQ2",
  "delete_token": "save-this-token",
  "expires_at": "2026-08-04T10:00:00+00:00",
  "max_views": 25
}

The delete token is shown once. Send it in X-Delete-Token to DELETE /api/v1/pastes/{id}. Raw URLs are omitted for private, password-protected, and encrypted pastes.

Account API tokens

Create a token from My Pastes → API access. Send it as a Bearer token. Tokens are stored as one-way hashes, shown once, independently revocable, and currently carry read, write, and delete scopes.

curl https://pastebin.ai/api/v1/account/pastes \
  -H "Authorization: Bearer pba_your_token"

GET /api/v1/account/pastes

List up to 100 pastes owned by the token’s account.

GET /api/v1/account/pastes/{id}

Retrieve metadata and content, including account-private pastes.

PATCH /api/v1/account/pastes/{id}

Update content and metadata. Updating creates a revision snapshot. Encrypted ciphertext cannot be replaced through this endpoint.

DELETE /api/v1/account/pastes/{id}

Delete a paste owned by the token’s account.

Public retrieval

GET /api/v1/pastes/{id}

Returns available public or unlisted content. Owner-private, password-protected, and client-encrypted content is intentionally unavailable here.

Expiration and limits

Expiration values are 10m, 1h, 1d, 1w, 2w, 1m, 6m, 1y, and never. An optional max_views value from 1 to 1,000 makes a paste unavailable after the selected number of counted unique views; repeat requests from the same viewer within 24 hours count once. Burn-after-read is a separate one-retrieval mode and overrides the view limit. Content is limited to 1 MB UTF-8. Creation endpoints return HTTP 429 with Retry-After when a rate limit is exceeded.

CORS and encrypted browser pastes

Read and preflight API responses include CORS headers. The website’s client-side encrypted mode uses Web Crypto before calling the API, so the normal storage request receives ciphertext and the key remains in the URL fragment. API clients that reproduce this flow are responsible for key generation and secure key distribution.

Task-focused API guides

curl quickstart

Create, retrieve, and delete a short-lived paste.

Authentication

Store, rotate, and revoke account tokens.

Errors and limits

Handle status codes and Retry-After safely.

Python client

Use timeouts and explicit status checks.

JavaScript client

Use fetch without exposing account tokens.

Pastebin API questions

Is authentication required for the Pastebin API?

Anonymous paste creation and eligible retrieval do not require authentication. Owned management endpoints require a Bearer account token.

What is the maximum paste size?

Paste content is limited to 1 MB of UTF-8 bytes. Use the local text counter before sending large content.

Can protected pastes use raw URLs?

No. Owner-only, password-protected, and encrypted content does not expose an ordinary raw endpoint.