API reference

DropText stores pastes directly in Supabase. There's no separate backend — you talk to the same REST endpoint the web app uses, with the public anon key.

Base URL

https://bfglvrktpepdcvgswzuv.supabase.co/rest/v1/pastes

Every request needs these headers:

apikey: sb_publishable_E8gZ23gaLdaVaTqkbVf3SA_IFLiCaXs
Authorization: Bearer sb_publishable_E8gZ23gaLdaVaTqkbVf3SA_IFLiCaXs
Content-Type: application/json

Create a paste

curl -X POST \
  'https://bfglvrktpepdcvgswzuv.supabase.co/rest/v1/pastes' \
  -H 'apikey: sb_publishable_E8gZ23gaLdaVaTqkbVf3SA_IFLiCaXs' \
  -H 'Authorization: Bearer sb_publishable_E8gZ23gaLdaVaTqkbVf3SA_IFLiCaXs' \
  -H 'Content-Type: application/json' \
  -d '{
    "id": "my-slug",
    "content": "hello world",
    "edit_token": "some-random-token",
    "language": "plaintext"
  }'

Read a paste

curl 'https://bfglvrktpepdcvgswzuv.supabase.co/rest/v1/pastes?id=eq.my-slug&select=*' \
  -H 'apikey: sb_publishable_E8gZ23gaLdaVaTqkbVf3SA_IFLiCaXs'

Raw text view

Open any paste with &raw=1 appended for a plain-text render, e.g:

https://yourdomain.com/index.html?id=my-slug&raw=1

Fields

id               text, primary key, the share slug
content          text, paste body (or ciphertext if encrypted)
password_hash    sha-256 hex, null if no password
burn_after_read  boolean
language         text, for syntax highlighting
edit_token       text, required to update the paste later
expires_at       timestamptz, null = never
tags             text, comma separated
encrypted        boolean
view_count       integer
versions         jsonb array of past revisions

Encryption

When a paste is encrypted client-side, content is AES-GCM ciphertext and the decryption key lives only in the URL fragment (#k=...), which is never sent to the server. The API alone cannot decrypt those pastes.

Rate limits

Max paste size is 200KB, enforced client-side. There's no server-side rate limiting since this runs on Supabase's free tier — be reasonable.