Publish to HashBin from your app

1. Register your app below to get a client_id. That's the only credential your app needs, because it proves who it is with PKCE (why no client secret?).
2. Redirect users to /oauth/authorize with PKCE parameters.
3. The user signs in (via their existing HashBin account) and approves your app.
4. HashBin redirects back to your redirect_uri with an authorization code.
5. Exchange the code at /oauth/token for an access token (15 minutes) and refresh token (7 days idle, 90 days maximum).
6. Use the access token to publish content via POST /api/content. Uploads use the user's default retention period, are billed to their balance, and return a content URL on https://256t.us/{cid}.

If your app is hosted on GitHub Pages, register your Pages URL as the redirect URI. The simplest setup is a single page that starts sign-in, receives the user back from HashBin, and publishes. A minimal version using the hosted SDK:

<!-- https://your-username.github.io/your-repo/ (registered as the redirect URI) -->
<button id="publish">Publish "Hello, HashBin!"</button>
<script type="module">
  import { HashBinClient } from 'https://hashbin.org/sdk/hashbin.js';

  const hb = new HashBinClient({
    clientId: 'YOUR_CLIENT_ID',
    redirectUri: 'https://your-username.github.io/your-repo/',
    baseUrl: 'https://hashbin.org' // also the SDK default
  });

  // Redirect fallback: verify the result and restore your saved app state.
  if (location.hash.includes('hashbin_publish')) {
    const result = await hb.handlePublishCallback();
    console.log('Published:', result.cid);
    history.replaceState(null, '', location.pathname);
  }

  document.getElementById('publish').onclick = async () => {
    const result = await hb.publish('Hello, HashBin!', { contentType: 'text/plain' });
    console.log('Published:', result.cid);
  };
</script>

For a complete app that also handles sign-in errors, token renewal and drafts, see Textpad.

See the SDK documentation for the full API reference.

Textpad is a small text editor in one HTML file. It opens text from a #256t= link, lets the user edit it, and saves it to their HashBin account through OAuth. The walkthrough explains every part of the code, so it makes a good starting point for your own app.

Read the Textpad walkthrough · Open Textpad

Building a phone app? Textpad is also available for Expo (React Native) and Flutter, with the same features.

Upload via API key: fastest manual upload flow, supports selecting retention per upload, but requires handling an API key in the page.

Open Upload via API Key

Upload via registered app: OAuth app flow with scoped and revocable access, no API key sharing, and uploads billed using the user's default retention settings.

Open Upload via Registered App

Ask only for what your app needs: the user sees each permission, can uncheck any of them, and sets a monthly spending limit (required for anything that spends), a retention cap and an expiry. Your app can suggest a cap with the spending_limit (US dollars) and max_retention_months parameters; the user can only lower them. A token request may pass scope to get a token with fewer of the granted scopes. Account management (keys, apps, settings, deposits) is never available to apps.