# pastebin.ca

> pastebin.ca is a short-link paste service for sharing text and code. It pairs a
> fast human web UI with first-class machine surfaces: a documented REST API, a
> Model Context Protocol (MCP) server, raw content delivery, syntax highlighting,
> per-line annotations, client-side encryption, expiry controls, forking/revisions,
> and passkey/GitHub accounts. This file points AI agents and automated clients at
> the machine-readable surfaces so they don't have to scrape HTML.

Why pastebin.ca exists: most snippet sharing is throwaway, but the link often
outlives the moment — in a chat, a ticket, a code review, an agent transcript.
pastebin.ca treats the paste and its share link as the product: pick how
discoverable a paste should be, share the right link, and keep control through
expiry, accounts, revisions, signed capability links, and end-to-end encryption.

Access model (orthogonal axes):
- `visibility`: `public` (listed in the public feed), `profile` (listed on the
  owner's public profile), or `unlisted` (reachable only by direct link).
- `access`: `public` (anyone with the link), `signed_url` (a `?s=` capability
  token in the URL grants access), or `e2e` (client-side encrypted; the server
  never sees plaintext or the key).

Agents should prefer the API or MCP over scraping rendered HTML. Fetch raw paste
bodies from the content host, and discover the full API from the OpenAPI document.

## Documentation
- [User guide](https://pastebin.ca/docs): how to create, share, read, manage, and automate pastes.
- [Agents & automation](https://pastebin.ca/docs/agents): REST, MCP, and proof-of-work access for non-interactive clients.
- [MCP server setup](https://pastebin.ca/docs/mcp): connect Claude Desktop, Cursor, the MCP Inspector, or any MCP client.
- [Workflows](https://pastebin.ca/docs): task-oriented recipes (CI artifacts, encrypted delivery, config revisions, release-note feeds, read/transform raw content, MCP client setup).
- [Help & FAQ](https://pastebin.ca/help): posting, expiry, encryption, accounts, and agent access.

## API
- [OpenAPI 3 specification (JSON)](https://pastebin.ca/api/v1/openapi.json): the authoritative, machine-readable description of every REST endpoint, schema, and auth scheme.
- REST base path: `https://pastebin.ca/api/v1/`. Create a paste with `POST /api/v1/pastes`, read with `GET /api/v1/pastes/{id}`.
- Auth: send an API key as `Authorization: Bearer <key>`, or use a session cookie. Anonymous public creates require a Turnstile or proof-of-work challenge; authenticated clients do not.

## MCP (Model Context Protocol)
- Endpoint: `https://pastebin.ca/mcp` (JSON-RPC 2.0 over HTTP POST; GET negotiates the streaming transport).
- Discover capabilities at runtime with `tools/list`; every tool ships an `inputSchema`, an `outputSchema`, and a human description. Tools cover creating, reading, listing, forking, and managing pastes.
- Auth: an `Authorization: Bearer <api-key>` header, a session cookie, or OAuth.
- [OAuth Protected Resource Metadata (RFC 9728)](https://pastebin.ca/.well-known/oauth-protected-resource): how to obtain and present tokens for the MCP resource.
- [OAuth Authorization Server Metadata (RFC 8414)](https://pastebin.ca/.well-known/oauth-authorization-server): authorization, token, and dynamic client registration endpoints.

## Raw content
- Raw paste bodies are served at `https://raw.anybin.ca/{id}` and at `https://pastebin.ca/{id}/raw`. Append a `?s=<token>` capability for signed-url pastes. End-to-end encrypted pastes return ciphertext only.

## Policies
- [Terms of Use](https://pastebin.ca/terms)
- [Privacy Policy](https://pastebin.ca/privacy)
- [Report abuse](https://pastebin.ca/abuse): abusive pastes, copyright notices, and law-enforcement requests.
- [security.txt](https://pastebin.ca/.well-known/security.txt): security contact and disclosure policy.

## Notes for crawlers and agents
- Do not crawl, index, store, or share `?s=` signed URLs — the token *is* the secret (capability-as-URL). These pages also emit `noindex`.
- Unlisted, signed-url, encrypted, single-use, and expired pastes emit `noindex` (meta + `X-Robots-Tag`) and are not part of the indexable corpus.
- Public, listed pastes (`public`/`profile` visibility with `public` access) emit a self-canonical, indexable page; public profile pages under `/u/` are indexable.
- Respect `https://pastebin.ca/robots.txt` and the per-page robots directives.

## Optional
- [Live public feed](https://pastebin.ca/feed): recently shared public pastes (HTML; for the machine feed use the API).
- [pbca CLI](https://pastebin.ca/cli): command-line client for macOS, Linux, and Windows.
- [Sitemap](https://pastebin.ca/sitemap-index.xml): locale-mirrored chrome routes.