Account API tokens are bearer credentials: Possession is sufficient to use their granted access. Pastebin.ai shows the secret once and stores only a one-way hash, so clients must store it safely and rotate it when exposure is possible.
Create a token for one workflow
Create tokens from the signed-in account workspace. Name each token after its client or environment rather than using one credential everywhere. Separate deployment, support, and personal scripts so one revocation does not interrupt unrelated work.
Send the token over HTTPS
Use the Authorization header with the Bearer scheme. Never place a token in a query string, paste URL, browser bundle, public repository, screenshot, or diagnostic log. Redact authorization headers before sharing HTTP transcripts.
Practical next step: API token security guide - Apply rotation and storage principles.
Store and rotate safely
Use environment-specific secret storage or the operating system credential facility. Rotate after personnel, device, or deployment changes and immediately after suspected exposure. Revoke unused tokens from the account page.
Understand account scope
Authenticated endpoints act only on pastes owned by the token account. Application code should still apply least privilege, validate paste identifiers, and handle authorization failures without retry loops that leak information.
Primary sources and further reading
These references support the standards and implementation concepts used in Pastebin API authentication. Product behavior is checked separately against Pastebin.ai.