API Docs - fastpaste.xyz

Getting Started

The FastPaste API lets you create, retrieve and delete pastes programmatically.

An API key is required to use the API. Contact the administrator to obtain one.

Authentication

All API requests require the X-API-Key header:

X-API-Key: lq_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Base URL

https://fastpaste.xyz/api/v1

Response Format

All responses are in JSON format:

{
    "error": false,
    "message": "...",
    "data": { ... }
}

POST /api/v1/paste

Creates a new paste.

Text Paste (JSON)

Parameter	Type	Required	Description
`content`	string	Yes	Paste content (min 3, max 4.00 MB)
`title`	string	No	Paste title
`description`	string	No	Description (max 500 characters)
`expiry`	string	No	Duration: 10m, 30m, 1h, 3h, 6h, 12h, 1d, 2d, 3d, 1w, 2w, 1m, never (default: 1d)
`password`	string	No	Password protection
`burn`	boolean	No	View once and delete. If true, the paste is automatically deleted after the first view (default: false).
`encrypt`	boolean	No	End-to-end encryption. If true, content must be a client-encrypted "fpe1:..." string (see the E2E section). Default: false.
`key`	string	No	Base64url decryption key. Optional; used only to append #key to the returned link and is never stored on the server. Leave empty to keep the key fully client-side.
`downloadable`	boolean	No	Makes an E2E encrypted paste downloadable (default: false). Meant to be used with encrypt=true; on non-encrypted pastes it has no effect and the response includes a warning (non-encrypted pastes are always downloadable anyway).
`language`	string	No	Syntax highlighting language (e.g. python, javascript). Auto-detected if omitted; for E2E it is stored to highlight after decryption.
`public`	boolean	No	If true, the paste is listed in the public archive and sitemap. Defaults to false. Ignored when a password, burn-after-read or encryption is used.
`slug`	string	No	Custom short address (e.g. "my-notes" → /view/my-notes). If taken, a similar one is assigned.

Example Request (cURL)

curl -X POST https://fastpaste.xyz/api/v1/paste \
  -H "Content-Type: application/json" \
  -H "X-API-Key: lq_your_api_key_here" \
  -d '{
    "content": "print(\"Hello, World!\")",
    "title": "Test Paste",
    "expiry": "1d",
    "burn": true
  }'

Response (201 Created)

{
    "error": false,
    "message": "Paste created successfully.",
    "data": {
        "paste_id": "aB3cD4eF5g",
        "url": "https://fastpaste.xyz/view/aB3cD4eF5g",
        "raw_url": "https://fastpaste.xyz/raw/aB3cD4eF5g",
        "download_url": "https://fastpaste.xyz/download/aB3cD4eF5g",
        "expires_at": "2025-01-02 15:30:00",
        "sha256": "abc123...",
        "burn_after_read": true,
        "encrypted": false,
        "downloadable": false
    }
}

File Upload (multipart/form-data)

Parameter	Type	Required	Description
`file`	file	Yes	File to upload (max 10.00 MB)
`description`	string	No	File description
`expiry`	string	No	Expiry
`password`	string	No	Password protection
`burn`	boolean	No	View once and delete. If true, the paste is automatically deleted after the first view (default: false).
`encrypt`	boolean	No	End-to-end encryption. If true, content must be a client-encrypted "fpe1:..." string (see the E2E section). Default: false.
`key`	string	No	Base64url decryption key. Optional; used only to append #key to the returned link and is never stored on the server. Leave empty to keep the key fully client-side.
`downloadable`	boolean	No	Makes an E2E encrypted paste downloadable (default: false). Meant to be used with encrypt=true; on non-encrypted pastes it has no effect and the response includes a warning (non-encrypted pastes are always downloadable anyway).

Example (file with cURL)

curl -X POST https://fastpaste.xyz/api/v1/paste \ -H "X-API-Key: lq_your_api_key_here" \ -F "[email protected]" \ -F "expiry=1w"

End-to-End Encryption (E2E)

Encrypt the content on your side with AES-GCM (256-bit), then send the ciphertext as content. The server stores only the encrypted data and never sees the plaintext. The same format as the web interface is used.

Ciphertext format: fpe1:<base64(iv)>:<base64(ciphertext)> — where iv is a random 12-byte value and the ciphertext includes the GCM tag.

The decryption key is never stored on the server. If you send the optional key parameter, the returned url contains it as #key and the link is directly usable; the key is used only to build the link, not stored. For stricter E2E, omit key and append the #key part to the link yourself.

Downloading: E2E pastes are NOT downloadable by default (/download returns 403 and download_url is null in the response). If created with downloadable=true, /download serves the encrypted "fpe1:..." content (decrypt it yourself with your key); the Download button on the view page decrypts the content in the browser with the #key and downloads it as plaintext.

If downloadable=true is sent with a non-encrypted paste (encrypt=false), the request is still accepted, but the response includes a "warning" field.

Example Request (cURL)

curl -X POST https://fastpaste.xyz/api/v1/paste \
  -H "Content-Type: application/json" \
  -H "X-API-Key: lq_your_api_key_here" \
  -d '{
    "content": "fpe1:<base64-iv>:<base64-ciphertext>",
    "encrypt": true,
    "key": "<base64url-key>",
    "downloadable": true,
    "expiry": "1d"
  }'

Response (201 Created)

{
    "error": false,
    "message": "Paste created successfully.",
    "data": {
        "paste_id": "aB3cD4eF5g",
        "url": "https://fastpaste.xyz/view/aB3cD4eF5g#<base64url-key>",
        "raw_url": "https://fastpaste.xyz/raw/aB3cD4eF5g",
        "download_url": "https://fastpaste.xyz/download/aB3cD4eF5g",
        "expires_at": "2025-01-02 15:30:00",
        "sha256": "abc123...",
        "burn_after_read": false,
        "encrypted": true,
        "downloadable": true
    }
}

GET /api/v1/paste/{id}

Retrieves the details and content of a paste.

Password-protected pastes cannot be retrieved via the API.

Burn-after-read pastes are permanently deleted right after the first successful retrieval, whether via this endpoint or /raw.

Example Request (cURL)

curl https://fastpaste.xyz/api/v1/paste/aB3cD4eF5g \
  -H "X-API-Key: lq_your_api_key_here"

Response (200 OK)

{
    "error": false,
    "data": {
        "paste_id": "aB3cD4eF5g",
        "title": "Test Paste",
        "description": null,
        "content": "print(\"Hello, World!\")",
        "content_type": "text",
        "original_filename": null,
        "language": "python",
        "file_size": 22,
        "sha256": "abc123...",
        "created_at": "2025-01-01 15:30:00",
        "expires_at": "2025-01-02 15:30:00",
        "view_count": 5,
        "burn_after_read": false,
        "burned": false,
        "encrypted": false,
        "downloadable": false
    }
}

PUT /api/v1/paste/{id}

Updates an existing paste (only those owned by this API key). Send only the fields you want to change: content (text only), title, description, expiry, burn, password, language, downloadable. If content is "fpe1:...", include encrypt and key.

Example Request (cURL)

curl -X PUT https://fastpaste.xyz/api/v1/paste/aB3cD4eF5g \
  -H "Content-Type: application/json" \
  -H "X-API-Key: lq_your_api_key_here" \
  -d '{
    "title": "Updated title",
    "content": "new content",
    "expiry": "1w"
  }'

Response (200 OK)

{
    "error": false,
    "message": "Paste updated successfully.",
    "data": {
        "paste_id": "aB3cD4eF5g",
        "url": "https://fastpaste.xyz/view/aB3cD4eF5g",
        "encrypted": false
    }
}

GET /api/v1/pastes

Lists pastes created with this API key (newest first). Pagination: page and limit (1–100).

Example Request (cURL)

curl "https://fastpaste.xyz/api/v1/pastes?page=1&limit=20" \
  -H "X-API-Key: lq_your_api_key_here"

Response (200 OK)

{
    "error": false,
    "data": [
        {
            "paste_id": "aB3cD4eF5g",
            "url": "https://fastpaste.xyz/view/aB3cD4eF5g",
            "title": "Test Paste",
            "content_type": "text",
            "language": "python",
            "file_size": 22,
            "created_at": "2025-01-01 15:30:00",
            "expires_at": "2025-01-02 15:30:00",
            "view_count": 5,
            "encrypted": false,
            "downloadable": false
        }
    ],
    "pagination": { "page": 1, "limit": 20, "total": 1, "total_pages": 1 }
}

GET /api/v1/paste/{id}/raw

Returns paste content as plain text. Suitable for scripts and automation.

Example

curl https://fastpaste.xyz/api/v1/paste/aB3cD4eF5g/raw \
  -H "X-API-Key: lq_your_api_key_here"

Response: Content-Type: text/plain

DELETE /api/v1/paste/{id}

Deletes a paste. Only pastes created with the same API key can be deleted.

Example

curl -X DELETE https://fastpaste.xyz/api/v1/paste/aB3cD4eF5g \
  -H "X-API-Key: lq_your_api_key_here"

Response (200 OK)

{"error": false, "message": "Paste deleted."}

POST /api/v1/cli

Quickly create pastes from the command line (curl). Send content as a raw request body from stdin, or as a form field (content/paste/f:1). The default response is a plain-text URL.

The API key is optional: it works anonymously without a key (IP rate limit + content scan). If a key is provided, usage is attributed to it. Anonymous access can be disabled in the admin panel.

Parameter

Parameter	Type	Required	Description
`(gövde)`	raw / form	Yes	Paste content. For raw body, text/plain is recommended (so = and & are preserved).
`expiry`	string	No	Duration: 10m, 30m, 1h, 3h, 6h, 12h, 1d, 2d, 3d, 1w, 2w, 1m, never (default: 1d)
`title`	string	No	Paste title
`lang`	string	No	Syntax highlighting language (e.g. python, javascript). Auto-detected if omitted; for E2E it is stored to highlight after decryption.
`burn`	boolean	No	View once and delete. If true, the paste is automatically deleted after the first view (default: false).

Example Request (cURL)

# stdin → URL (text/plain önerilir)
echo "merhaba" | curl -H "Content-Type: text/plain" --data-binary @- https://fastpaste.xyz/api/v1/cli

# dosya yükle
curl -H "Content-Type: text/plain" --data-binary @app.log https://fastpaste.xyz/api/v1/cli

# sprunge/ix.io tarzı
echo "merhaba" | curl -F 'f:1=<-' https://fastpaste.xyz/api/v1/cli

# seçeneklerle
cat x.py | curl -H "Content-Type: text/plain" --data-binary @- 'https://fastpaste.xyz/api/v1/cli?expiry=1w&lang=python'

# API anahtarı ile (kota anahtara işlenir)
cat x | curl -H "X-API-Key: lq_xxx" -H "Content-Type: text/plain" --data-binary @- https://fastpaste.xyz/api/v1/cli

Response

https://fastpaste.xyz/view/aB3cD4eF5g

Accept: application/json veya ?json=1 ile JSON döner. GET /api/v1/cli kullanım örneklerini gösterir.

Allowed File Extensions

.txt .log .json .xml .yaml .yml .ini .cfg .conf .md .csv .sql .js .ts .html .htm .css .py .java .go .rs .c .cpp .h .hpp .lua .rb .jsx .tsx .vue .svelte .scss .sass .less .toml .gitignore .dockerfile .makefile .bat .ps1 .r .swift .kt .kts .scala .pl .pm .tcl .awk .sed .diff .patch .tf .hcl .proto .graphql .tex .bib .rst .adoc .org .wiki .properties .gradle .cmake .mak

Files are checked against both extension and MIME type. Only text/code files are accepted.

Rate Limits

Separate rate limits can be defined for each API key:

Limit Type	Description
Hourly Limit	Maximum requests per hour (0 = unlimited)
Daily Limit	Maximum requests per day
Monthly Limit	Maximum requests per month

When the limit is exceeded, a 429 Too Many Requests response is returned.

Error Codes

Code	Meaning
`400`	Bad request (missing or invalid parameter)
`401`	API key missing
`403`	Invalid/inactive API key or access denied
`404`	Paste not found or expired
`405`	HTTP method not allowed
`413`	File size too large
`429`	Rate limit exceeded
`500`	Server error
`503`	API disabled

Webhook Notifications

A separate webhook URL can be configured per API key. A POST request is sent when a new paste is created:

{
    "event": "paste_created",
    "paste_id": "aB3cD4eF5g",
    "type": "text",
    "source": "api",
    "api_key_name": "My App",
    "url": "https://fastpaste.xyz/view/aB3cD4eF5g",
    "raw_url": "https://fastpaste.xyz/raw/aB3cD4eF5g",
    "download_url": "https://fastpaste.xyz/download/aB3cD4eF5g",
    "expires_at": "2025-01-02 15:30:00",
    "created_at": "2025-01-01 15:30:00",
    "ip": "1.2.3.4"
}

FastPaste API

Getting Started

Authentication

Base URL

Response Format

POST /api/v1/paste

Text Paste (JSON)

File Upload (multipart/form-data)

End-to-End Encryption (E2E)

GET /api/v1/paste/{id}

PUT /api/v1/paste/{id}

GET /api/v1/pastes

GET /api/v1/paste/{id}/raw

DELETE /api/v1/paste/{id}

POST /api/v1/cli

Parameter

Allowed File Extensions

Rate Limits

Error Codes

Webhook Notifications

Get an API Key