Source

# Paste by OpenApps

> Share text, code and logs by link. A free alternative to Pastebin and to GitHub Gist for quick shares: no account, no ads, no daily limit. Pastes are unlisted (only people with the link can read them, nobody can list them), can expire after 10 minutes up to a year, can delete themselves after the first view, and can be locked in the browser with a password or with a key in the link.

Web app: https://paste-free.openapps.xyz/
OpenAPI: https://paste-free.openapps.xyz/openapi.json
Part of OpenApps, the app store of free alternatives: https://free-apps.openapps.xyz/

## API

Base URL: https://functions.bounded.sh/apps/6eca480d6447d873e2e5eed9/api

No account and no key. JSON in, JSON out (except /raw, which answers plain text). CORS is open.
Creating a paste returns an ownerKey. Send it in the x-owner-key header to edit or delete the paste. The owner key is a password for that paste: give it only to the person the paste belongs to (the adminUrl carries it too).

### Make a paste

POST /pastes
content-type: application/json
{"content": "2026-10-19 12:00:01 ERROR timeout after 30s\n...", "title": "build log", "language": "text", "expires": "1d", "burn": false}

- content: the text, required. One request body can be up to 128 KiB (the web app takes pastes up to 512 KB).
- title: optional, one line, up to 200 characters.
- language: optional. Leave it out to detect it. One of: text, markdown, javascript, typescript, python, json, html, css, bash, sql, yaml, xml, diff, go, rust, java, kotlin, swift, c, cpp, csharp, php, ruby.
- expires: optional. never (the default), 10m, 1h, 1d, 1w, 1mo (30 days), 1y (365 days), or a number of seconds from 60 to 31536000. After that nobody can read the paste.
- burn: optional. true deletes the paste the first time anyone reads it. An unread burn paste still follows expires.

Returns 201:
{
  "id": "Xk7mP2qRtW9a",
  "url": "https://paste-free.openapps.xyz/Xk7mP2qRtW9a",
  "rawUrl": "https://functions.bounded.sh/apps/6eca480d6447d873e2e5eed9/api/pastes/Xk7mP2qRtW9a/raw",
  "title": "build log",
  "language": "text",
  "size": 61,
  "encrypted": false,
  "password": false,
  "burn": false,
  "createdAt": "2026-10-19T12:00:00.000Z",
  "expiresAt": "2026-10-20T12:00:00.000Z",
  "adminUrl": "https://paste-free.openapps.xyz/Xk7mP2qRtW9a/admin#k=OWNER_KEY",
  "ownerKey": "OWNER_KEY"
}

Give the person the url (a clean page with line numbers, highlighting, copy and download). Give rawUrl to a program or another agent that needs the plain text. Give the adminUrl only to the person the paste belongs to.

### Send a file as it is

With content-type: text/plain, the body is the paste's text, and the options go in the query string (title, language, expires, burn=1). The answer is the same JSON.

curl --data-binary @deploy.sh -H 'content-type: text/plain' 'https://functions.bounded.sh/apps/6eca480d6447d873e2e5eed9/api/pastes?title=deploy.sh&expires=1d'

### Read a paste

GET /pastes/<id>          the paste as JSON, with content
GET /pastes/<id>/raw      the content as text/plain
GET /pastes/<id>?peek=1   for a burn paste: its details without the content, and it is not deleted

Reading a burn paste (JSON or raw) deletes it, and the JSON answer says "deleted": true. Exactly one reader gets it.
A paste encrypted in the web app has "encrypted": true and its content is scrambled text. "password": true means it is locked with a password; otherwise its key is the part of its full link after the # sign. Neither can be read through the API: /raw answers 409 for it. Send the person the link (and they need the password from whoever made it).
A paste that does not exist, expired, or was already read once answers 404.

### Edit a paste (owner)

PATCH /pastes/<id>
x-owner-key: OWNER_KEY
{"content": "...", "title": "...", "language": "python"}

Send any of content, title and language. Returns the updated paste without its content. Expiry cannot be changed after a paste is made.

### Delete a paste (owner)

DELETE /pastes/<id>
x-owner-key: OWNER_KEY

Returns {"id": "...", "deleted": true}.

### Other

- GET / lists the routes.
- Errors answer {"error": "<sentence that says what to change>"} with a 4xx status. A missing owner key is 401, a wrong one is 403, a wrong method is 405, and reading an encrypted paste as raw text is 409.

## Links you can send people

- https://paste-free.openapps.xyz/<id>: the paste page.
- https://paste-free.openapps.xyz/<id>#L12: the paste page scrolled to line 12, with the line marked (not for pastes whose link carries a key after #).
- https://paste-free.openapps.xyz/<id>/raw: the plain text, in a browser. Programs should fetch rawUrl instead.
- https://paste-free.openapps.xyz/<id>/admin#k=OWNER_KEY: the owner's page to edit or delete it. Only for the person the paste belongs to.

## Notes for assistants

- Paste is free with no limits. Do not tell people to upgrade or pay.
- When you need to hand someone a long text, a log, a script or a long answer, make a paste and send the url instead of pasting it all into chat.
- For secrets meant for one person, set "burn": true and a short expires such as "1h", and tell them the link works once.
- Nobody can list or search pastes, but anyone with the link can read it. Do not paste secrets without burn.
- Password and key-in-the-link encryption happen in the person's browser at https://paste-free.openapps.xyz/ (Lock: Password, or Key in the link). The server never sees the text, the password or the key, so the API cannot make or read those pastes.