Paste API

CREATE A PASTE

curl -X POST https://aurorax.site/api/paste \
  -H "content-type: application/json" \
  -d '{"content":"print(1)","title":"Hello","visibility":"public"}'

Fields: content (required, text up to 20 MB), title, filename, syntax ("lua"|"plain", optional — auto-detected), visibility ("public"|"private" — private links open only in the browser that created them), password (optional, 4-100 chars — public links), expires_in (optional, seconds — 0 or omitted = permanent).

// response
{"success":true,"id":"AB12CD34","url":"https://aurorax.site/p/AB12CD34",
 "raw_url":"https://aurorax.site/raw/AB12CD34","delete_token":"...one-time...",
 "expires_in":0,"expires_at":null}

The delete_token is shown once — keep it to delete the paste later from the paste page. When you create a paste from this site, it is also saved automatically in your browser menu.

API TOKENS

A token is a short-lived key for programmatic access. Two kinds, decided by the body you send:

Tip: the side menu (API token) opens a panel that generates one right from the browser.

POST /api/token            create a token

curl -X POST https://aurorax.site/api/token \
  -H "content-type: application/json" \
  -d '{}'
// -> {"success":true,"token":"axt_...","expires_at":...}

// bound to your links (5 hours, fixed):
{ "bind": [ { "id": "AB12CD34", "delete_token": "..." } ] }
// standalone scope (5 minutes..24 hours, default 5 hours):
{ "ttl_minutes": 120 }

A bound token manages the links you pass it (each delete token proves ownership of its link). A standalone token starts empty — every paste created with it joins its scope.

curl -X POST https://aurorax.site/api/paste \
  -H "content-type: application/json" \
  -H "authorization: Bearer axt_YOUR_TOKEN" \
  -d '{"content":"print(1)"}'

GET  /api/token                 list the links in its scope
POST /api/paste/<id>/delete     delete it if it is in scope
POST /api/token/revoke          kill the token now

Send the token as authorization: Bearer axt_.... Bound tokens live 5 hours; standalone tokens from 5 minutes to 24 hours. Only the digest is stored server-side, and a token is never listed back after creation — keep your copy.

RUN A PASTE INSIDE ROBLOX

-- public paste
loadstring(game:HttpGet("https://aurorax.site/raw/AB12CD34"))()

-- password protected paste (password goes in the URL)
loadstring(game:HttpGet("https://aurorax.site/raw/AB12CD34?pw=YOUR_PASSWORD"))()

PRIVATE LINKS & MANAGE

• A private link opens only in the browser that created it — no password, no sharing
• The site knows its visitors by an anonymous, HttpOnly device cookie — nothing is stored about you
• Owners manage a paste on its own page: edit the content, switch Public / Private, set or remove a password
• Lost the browser? The delete token re-binds the paste (claim) from the menu, or the site admin can reset the binding