pastesiteDownload a Shared Paste With curl
AI-assisted article. Reviewed by Codebuff automated editorial review on 2026-11-04. Examples are illustrative, not real user data.
A paste link is useful in a browser and more useful in a pipeline, as long as the script handles three things a browser hides: the raw endpoint, the password header, and the difference between an expired paste and a missing one. The commands below use invented identifiers and a placeholder password.
Use the raw URL, not the HTML page
A normal paste has a plain-text endpoint that returns the stored text with no navigation, no scripts and no HTML wrapper. That is the URL to give a script. Downloading the human page and parsing it works until the page markup changes, and it drags a great deal of unrelated bytes through the pipe.
Ask curl to fail on an error status instead of saving the response body. Without that, a 404 or 410 is written to your output file as if it were the paste, and the next command in the pipeline fails somewhere less obvious.
# Save the plain text and fail on 4xx instead of writing an error page
curl -sS --fail-with-body https://pastesite.com/raw/EXAMPLEID -o reduced.json
# Read it into a pipeline without touching disk
curl -sS --fail https://pastesite.com/raw/EXAMPLEID | jq '.items | length'Passwords belong in a header
A password in a query string is written to shell history, proxy logs, browser history and server access logs. The paste API accepts the password in a request header for exactly that reason, and it deliberately does not accept it as a query parameter.
Keep the password out of the command line as well when the script is shared or recorded. Reading it from an environment variable or a file descriptor keeps it out of process listings, which is the same reason the command-line client reads its key from the environment.
curl -sS https://pastesite.com/raw/EXAMPLEID \
-H "x-paste-password: correct horse battery staple" \
-o reduced.json
# Not this: the password ends up in history and every log between you and the server
# curl "https://pastesite.com/raw/EXAMPLEID?password=..."Expiry and burn-after-read change the script
An expired paste and an unknown identifier are different answers, and a script should tell them apart before it retries. Expired means the deadline passed; unknown usually means a typo or a paste that was deleted. Retrying either one is pointless, and a retry loop against a burn-after-read paste can consume the only read.
Burn-after-read deletes the text on the first successful read, whether that read came from a browser or from curl. If the script might run twice, download once and keep the file; do not wrap the request in a retry that treats every failure as transient.
Pipes are the point
The raw endpoint exists so that ordinary tools can consume the text: jq for JSON, grep for a log excerpt, a diff against a local file. Set the shell to stop on a failed command so a broken download cannot be mistaken for empty content.
Do not echo the downloaded text into a build log. Build logs are often readable by more people than the paste was, and a link that expires in a day can leave a permanent copy in a log that outlives it.
Do not aim a secret at an unfamiliar host
Any script that fetches a URL is trusting that host with the request. A paste service is a third party, so treat the URL as you would any other external dependency, and do not paste a live credential into a service you would not send it to directly.
Browser-encrypted pastes have no raw endpoint on purpose. The server holds ciphertext it cannot read, so a script cannot fetch the plaintext, and the API answers with a conflict rather than serving something that looks like a successful read. If a pipeline needs a secret, use a secret manager rather than a paste.
Sources and editorial review
Prepared with AI assistance and checked against the API reference at the reviewed revision: the raw endpoint, the password header, the refusal of a password query parameter and the missing raw endpoint for encrypted pastes. The commands were not executed against a live paste; the identifiers and password are placeholders.