# VoidPaste > Ephemeral paste sharing for developers. Share code that shouldn't live forever. Free — no paid plans. Canonical site and API: https://voidpaste.com Paste, share a URL, and let the paste expire, burn after reading, or stay private. The web app and REST API are the same origin. Accounts are optional for basic pastes. ## Docs - [For agents](https://voidpaste.com/ai): Short explanation of how to call VoidPaste - [REST API](https://voidpaste.com/docs/api): Human reference for /api/v1 - [OpenAPI](https://voidpaste.com/openapi.yaml): OpenAPI 3.0.3 (text/yaml). This is the contract. Do not invent endpoints. - [CLI](https://voidpaste.com/docs/cli): Install and commands - [Security](https://voidpaste.com/security): Visibility, passwords, client-side encryption, and limits of those controls - [Pastebin alternative](https://voidpaste.com/pastebin-alternative): What VoidPaste is, compared with other paste tools - [Privacy](https://voidpaste.com/privacy): Privacy policy - [Terms](https://voidpaste.com/terms): Terms of use - [Acceptable use](https://voidpaste.com/acceptable-use): What not to upload ## Authentication Web sessions use an HttpOnly cookie named `vp_session` (Secure on production, SameSite=Lax). Mutations that use that cookie also need header `X-CSRF-Token` matching the `vp_csrf` cookie. `GET /api/v1/auth/csrf` issues the token. API keys use `Authorization: Bearer vp_live_…` (test keys use the `vp_test_` prefix). Bearer requests skip CSRF. Scopes are enforced when the caller is an API key: `pastes:read` for reads, `pastes:write` for create, update, and delete. `*` grants every scope. Session cookies are not scope-checked. Creating, listing, and revoking keys (`/api/v1/api-keys`) requires the session cookie; Bearer keys are rejected on those routes. The secret is shown once. Password-protected pastes: send `X-Paste-Password`. The password is not accepted on the query string. ## Paste API Base URL: https://voidpaste.com - Create: `POST /api/v1/pastes` (anonymous allowed). JSON field `content` is required. Omitted `visibility` defaults to `unlisted`. 201 body is `{ paste, warnings }`. - Get: `GET /api/v1/pastes/{id}` returns `{ paste, burned }` and increments `view_count` (and can burn). - Metadata: `GET /api/v1/pastes/{id}/meta` returns paste fields without `content`. It does not increment views and does not burn. HTML metadata uses this path. - Raw: `GET /api/v1/pastes/{id}/raw` or `GET /raw/{id}` (text/plain). - Download: `GET /api/v1/pastes/{id}/download` or `GET /download/{id}` (attachment). - List (authenticated): `GET /api/v1/me/pastes`. There is no public list of all pastes. - Delete (owner): `DELETE /api/v1/pastes/{id}` soft-deletes and returns 204. - Owner edit: `PATCH /api/v1/pastes/{id}`. `{id}` is the public paste id, not a database UUID. Optional header `Idempotency-Key` (at most 256 characters) applies only to `POST /api/v1/pastes`. The JSON response is replayed for 24 hours, scoped to the user id or, if anonymous, the client IP. Replays set `Idempotency-Replayed: true`. A second request with the same key while the first is still running returns 409 `idempotency_conflict`. If the header is present and the store is down, the API returns 503 `idempotency_unavailable`. Other routes ignore the header. Errors are JSON: `{ "error": { "code", "message", "request_id" } }`. ## Visibility and encryption - `public` — anyone with the URL. There is no public directory of pastes. - `unlisted` — anyone with the URL. This is the default. The link is the secret, not an access-control list. - `private` — owner only. Anonymous create is rejected. - `password` — anyone who presents the paste password. The hash is argon2id. A `password` field with any other visibility returns 400. The API allows anonymous password pastes. The CLI requires an API key for `--visibility private` and `--visibility password`. Client-side encryption is a flag (`client_encrypted: true`), not a visibility mode, and can combine with any visibility. The browser uses AES-256-GCM (Web Crypto). A random key stays in the URL fragment (`#…`) and is not sent on the HTTP request, or key material is derived with PBKDF2-HMAC-SHA256 (310,000 iterations). The server stores ciphertext and metadata only. It does not store the AES key, the fragment, or the encryption password. That does not hide fields the server still has (visibility, expiration, size, timestamps, owner). It does not protect you if the JavaScript from this origin, or a browser extension, is malicious. Lost keys cannot be recovered. The CLI uploads and downloads ciphertext; it does not decrypt. ## Expiration, burn, and views Expiration: `never` (also empty or `0`), `10m`, `1h`, `1d`, `1w`, `1M` (about 30 days — capital M; `1m` is one minute), other relative durations, or an RFC3339 timestamp in the future. `burn_after_reading`: the first successful authorized read returns the body with `burned: true`. Later reads are gone (410). `max_views`: optional integer. The read that reaches the limit still returns the body, then the paste is destroyed. Later reads are gone. ## Limits VoidPaste is free. There are no paid tiers. `/pricing` redirects to `/`. Each paste is at most 1,048,576 bytes (1 MB). Larger creates return 413. Rate limits are a Redis sliding window. The window is `ANON_CREATE_WINDOW_SEC`, default 3600 seconds, and that same window applies to every bucket below. Counts are the configured defaults: - Anonymous writes, per IP: 30 (`ANON_CREATE_RATE`) - Anonymous reads, per IP: 120 (`ANON_READ_RATE`) - Signed-in writes, per user: 120 (`AUTH_CREATE_RATE`) - Signed-in reads, per user: 300 (`AUTH_READ_RATE`) - API key writes, per key: 300 (`API_CREATE_RATE`) - API key reads, per key: 300 (same number as signed-in reads; there is no separate API read setting) Successful limited responses include `RateLimit-Limit` and `RateLimit-Remaining`. Over the limit: 429 `rate_limited` and `Retry-After`. If Redis is down, writes fail closed (503 `rate_limit_unavailable`); reads fail open. ## CLI Install: `go install github.com/fleames/voidpaste-cli/cmd/voidpaste@latest` The binary defaults to https://voidpaste.com. Sign in on the site, create a key (scopes `pastes:read` and `pastes:write`), then `voidpaste auth login --key vp_live_…`. Env `VP_API_KEY` (alias `VP_TOKEN`) overrides the stored key. Commands against production: `voidpaste create`, `get`, `raw`, `download`, `list`, `delete`, `whoami`, `status`. Collections: `voidpaste collection …`. Versions: `voidpaste versions …`. Details and flags: https://voidpaste.com/docs/cli. ## Do not claim - Not military-grade cryptography, not a zero-knowledge messenger, and not a certification (no SOC 2, ISO 27001, or HIPAA claim on the public site). - No paid plans. Billing HTTP routes are dormant operator hooks and return 501 when Stripe is not configured. Do not call them to upgrade an account. - Scopes are enforced for API keys, as described above. They are not stored-only. - Idempotency is implemented, and only for `POST /api/v1/pastes` with `Idempotency-Key`. - Secret scanning may warn or block a non-encrypted create. It does not catch every secret. - Use https://voidpaste.com only. Do not guess other hosts, ports, or private network names.