PastepileDeveloper API

A paste API that works from the browser

Most paste APIs assume a server is calling them. This one sends CORS headers on every response, so a frontend app can create and read pastes with plain fetch: no proxy, no backend, no CORS errors hiding the real failure.

Read the API docs

The whole quick start

Create a paste with fetch

const res = await fetch("https://www.pastepile.com/api/public/pastes", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    content: "hello from the browser",
    expiry: "1d",
    visibility: "unlisted",
  }),
});
const paste = await res.json();
// paste.url      -> the share link
// paste.raw_url  -> the plain-text URL
// paste.edit_key -> shown once; can update or delete the paste

That is a complete integration. Reading it back is GET /api/public/pastes/{slug} for JSON or GET /raw/{slug} for the plain text, both keyless.

What the CORS support actually covers

The usual failure with third-party APIs is not the happy path. It is the error path: the API sends CORS headers on 200s but not on 404s or rate limits, so every failure reaches your code as an opaque CORS error instead of a readable response. Here, CORS headers are applied at the response boundary. Successes, validation errors, 404s, 429s, and even preflight requests to unknown paths all carry them. This was hardened after a real Angular integration hit exactly that failure, and the fix is covered by a browser test in CI.

Auth is header-based (an API key when you have one). No cookies, so do not set credentials: "include".
Rate-limit headers (Retry-After and the X-RateLimit set) and X-Request-Id are exposed cross-origin, so browser code can implement honest backoff and quote a request id when reporting a problem.
Errors are one stable JSON envelope with a machine-readable code, a human-readable message, and the request id.

Limits, plainly

Keyless reads: 120 per minute per IP, forever. Keyless creates: 30 per hour per IP, with a burst cap of 30 per minute.
Paste size: 2 MB without a key, 25 MB with a Pro key. Expiry from 10 minutes to never, including burn-after-read.
Creating through the API without a key works until September 8, 2026; after that, API writes need a subscription and an API key. Reads stay keyless and free, and pasting in the browser stays free. We would rather say that here than surprise you in production.

The full tables, error codes, and every endpoint live in the API reference and the OpenAPI document.

Framework guides

Working code with error handling included, written per framework only where the framework actually changes the code:

What this is good for

Share-as-link features, exporting app state someone can hand to support, publishing generated output (reports, configs, snippets) without owning storage, and prototypes that need persistence before they deserve a database. Pastes are text, up to the size limits above, with expiry you control. It is not a general database and does not pretend to be one.

For content only its recipient should read, create the paste end-to-end encrypted in the browser; encryption happens client-side and the API cannot do it for you.

Read the API docs