Authentication

Developer API endpoints require an API key except:

• POST /api/dev/paste-lite/create
• PUT /api/dev/paste-lite/update/:ref
• DELETE /api/dev/paste-lite/delete/:ref

Quick paste creation may omit the key and use the anonymous rolling 24-hour limit for the request’s source IP. Keyless update and deletion require the private management token returned by creation in the X-Manage-Token header. Supplying an API key uses account ownership and the normal account-based monthly quota.

You can pass an API key in one of two ways:

x-api-key header (recommended)

curl https://api.anonpaste.com/api/dev/pastes/get/aB3xYz \
  -H "x-api-key: your_api_key_here"

Authorization: Bearer header

curl https://api.anonpaste.com/api/dev/pastes/get/aB3xYz \
  -H "Authorization: Bearer your_api_key_here"

The SDK always uses x-api-key internally.

Error responses

Status	Reason	Description
401	API key required	No key was provided
401	Invalid API key	The key doesn’t match any account
401	Management token required	Keyless Quick paste update/delete omitted X-Manage-Token
429	Monthly limit reached	Free quota exhausted and no credits available

Keeping your key safe

• Never expose your API key in client-side JavaScript or public repositories
• If a key is compromised, regenerate it from Settings → Developer — the old key is immediately invalidated
• For server-side applications, store the key in an environment variable:

export ANONPASTE_API_KEY="your_api_key_here"

import { AnonPaste } from 'anonpaste-sdk';

const anonpaste = AnonPaste.init({
  apiKey: process.env.ANONPASTE_API_KEY!,
});