# filebin.ca

> A file hosting/bin service for uploading, sharing, and managing files. Uploads
> receive stable view and direct download URLs, with owner controls for listing,
> metadata, deletion, and download limits. Files are scan-gated before broad
> availability where required. Accounts, OAuth, and API keys are federated from
> pastebin.ca.

## How it works

- Upload a file as raw bytes or multipart/form-data; metadata can include filename,
  title, and description.
- Public files expose share/view and direct download URLs. Owners can list, inspect,
  and delete their uploads, including scan state and download-limit metadata.
- Malware and abuse scanning can gate availability; clients should treat scan_state
  as authoritative for owner workflows.

## Developer docs

- [Developer guide](https://filebin.ca/docs): REST API, MCP, OAuth, and discovery.
- [OpenAPI 3.1 spec](https://filebin.ca/api/v1/openapi.json): the full REST contract.
- [MCP server](https://filebin.ca/mcp): Model Context Protocol endpoint for AI agents.
- [Agent card](https://filebin.ca/.well-known/agent.json): machine-readable capabilities.
- [MCP discovery](https://filebin.ca/.well-known/oauth-protected-resource/mcp): protected-resource metadata.

## API summary

- POST https://filebin.ca/api/v1/files — upload a file (scope file:create). Raw body or multipart file; optional x-filename, x-title, x-description headers.
- GET https://filebin.ca/api/v1/items/{id} — read file metadata; owners see scan and limit fields (scope file:read for owner API-key reads).
- GET https://filebin.ca/api/v1/account/items — list your files (scope file:read); filters include q.
- DELETE https://filebin.ca/api/v1/items/{id} — delete one of your files (scope file:delete).

## Authentication

- Account API keys are minted on https://pastebin.ca and audience-bound to https://filebin.ca.
- Send them as: Authorization: Bearer pbca_live_…
- OAuth 2.1 + PKCE (with optional DPoP) is available for interactive MCP clients;
  pastebin.ca is the authorization server.

## Policy

- Uploaded files may be scan-gated, blocked, removed, or rate limited for abuse.
- Owner-only fields expose scan state and download limits so clients can avoid
  assuming immediate public availability.
- Privacy: https://filebin.ca/privacy
- Report abuse at https://filebin.ca/abuse.
- The governing family policy lives at https://pastebin.ca/privacy, https://pastebin.ca/terms, and https://pastebin.ca/abuse.