vault

A tiny, serverless pastebin-like service built on Cloudflare Pages Functions and Workers KV.

Heavily inspired by LostLuma/starbin and Erisa/starbin-pages.

Most static assets are copied from the original haste-server; the toolbar icons and the vault.tf wordmark are custom (see Credits).

Features

• Syntax highlighting via highlight.js (107 language extensions)
• Document expiration via Expiration header (TTL 60s–1 year)
• Input validation on document keys and content size
• Timing-safe auth comparison (crypto.subtle.timingSafeEqual)
• Content-Security-Policy (no unsafe-inline for scripts)
• Security headers (X-Frame-Options, X-Content-Type-Options, etc.)
• Copy-to-clipboard and delete buttons in the UI
• Password-masked auth prompt for uploads and deletes
• Plausible analytics via self-hosted proxy worker (optional)
• Long browser + KV read caching of immutable pastes (CACHE_TTL)
• Deletions propagate globally within ~60s via deletion tombstones

Deploy

Fork repository, create a Pages project and connect it to your forked repo, then map a KV Namespace called STORAGE.

Set the Pages build command to npm run build and the build output directory to static. The build renders README.md into static/about.html, served at /about.

Required environment variables:

Variable	Description
CACHE_TTL	Cache duration in seconds for document reads (KV read cache + browser max-age)
DOCUMENT_KEY_SIZE	Length of generated document keys (default: 6)
MAX_DOCUMENT_SIZE	Maximum document size in bytes
SECRET_KEY	Authorization secret for uploads

Analytics (optional)

Page views are tracked via a self-hosted Plausible proxy worker (plausible-cf-worker).

To enable analytics:

1. Deploy the plausible-cf-worker to your Cloudflare zone
2. Add a route matching *yourdomain.com/zk/* pointing to the worker
3. Add your domain + Plausible script URL to the worker's PLAUSIBLE variable

No code changes are needed — the script tag is already in index.html. If the worker route is not configured, the script tag is a no-op (404).

API

POST /documents

Upload a new document. Returns the key and URL.

Headers:

Header	Required	Description
Authorization	Yes	Must match SECRET_KEY
Expiration	No	TTL in seconds (min 60, max 31536000)

Response:

{ "key": "M12KsL", "url": "https://example.com/M12KsL" }

GET /documents/:key

Retrieve a document as JSON.

Response:

{ "key": "M12KsL", "data": "document content here" }

GET /raw/:key

Retrieve a document as plain text.

DELETE /documents/:key

Delete a document. Requires authorization.

Headers:

Header	Required	Description
Authorization	Yes	Must match SECRET_KEY

Response:

{ "message": "Document deleted." }

Usage

Given the following script:

#!/bin/bash

URL="https://example.com"
SECRET_KEY="secret_password"

upload=$(curl --silent --fail --data-binary @${1:--}\
     -H "Authorization: ${SECRET_KEY}" ${URL}/documents) || {
    echo "ERROR: failed to paste document" >&2
    exit 1
}

key=$(jq -r .key <<< $upload)

echo "${URL}/${key}"

Assuming the script is named vault, running it looks like:

$ echo look ma no hands | vault
https://example.com/M12KsL

Or:

$ vault README.md
https://example.com/cIT3Ez

With expiration (1 hour):

$ echo "temporary paste" | curl --silent --fail --data-binary @- \
    -H "Authorization: ${SECRET_KEY}" \
    -H "Expiration: 3600" \
    ${URL}/documents | jq -r .key

Development

npm install
npm test

License

MIT License

Copyright (c) 2019 - 2022 Lilly Rose Berner
Copyright (c) 2022 Erisa A.
Copyright (c) 2022 - 2026 Martin Simon

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Credits

• Toolbar icons: Bootstrap Icons, MIT — Copyright (c) 2019-2024 The Bootstrap Authors.
• The vault.tf wordmark is set in Lato (SIL Open Font License) and ships as outlined SVG paths, not the font file.

Buy me a coffee?

If you feel like buying me a coffee (or a beer?), donations are welcome:

BTC : bc1qq04jnuqqavpccfptmddqjkg7cuspy3new4sxq9
DOGE: DRBkryyau5CMxpBzVmrBAjK6dVdMZSBsuS
ETH : 0x2238A11856428b72E80D70Be8666729497059d95
LTC : MQwXsBrArLRHQzwQZAjJPNrxGS1uNDDKX6