# ibin.co — full documentation


---

---
title: "Developer docs — imagebin.ca"
source: "https://ibin.co/docs"
---
Not a developer?This page is the technical guide (REST API, CLI, MCP). For how to upload, share, and use public vs private images, read the [user guide](/guide).

Documentation

# Build with ibin.co

REST API, the pbca CLI, and an MCP server for AI agents — all on your pastebin.ca account.

[Quick start](#quickstart) [REST API](#rest) [pbca CLI](#cli) [MCP for AI agents](#mcp) [OAuth & DPoP](#oauth) [Discovery](#discovery)

## Quick start

ibin.co shares your pastebin.ca account. There is nothing new to sign up for — install the CLI, mint an API key bound to this site, and you can drive everything from the terminal, your scripts, or an AI agent.

Audience-boundKeys are scoped to one site. A `image:*` key only works on `ibin.co`; it is rejected everywhere else.

**1.** Install the `pbca` CLI — a self-contained Rust binary:

```
curl -fsSL https://pastebin.ca/cli/install.sh | sh
```

Installs `pbca` to `/usr/local/bin` (override with `PBCA_INSTALL_PREFIX`). Prefer a direct download? Grab a platform binary — macOS, Linux, or Windows — from [pastebin.ca/cli](https://pastebin.ca/cli).

**2.** Mint a key bound to `ibin.co` on pastebin.ca:

```
pbca account api-key create \
  --scopes image:read,image:create,image:delete \
  --audience https://ibin.co
```

**3.** Give the key to the CLI via `PBCA_API_KEY` or `pbca account login`, then upload your first image:

```
pbca image upload ./your-image
```

## REST API

A small JSON surface. Send your key as `Authorization: Bearer <api-key>`. Anonymous browser uploads (with Turnstile) and signed-in cookie sessions also work; API-key callers must hold the matching scope.

### Scopes

image:read image:create image:delete

| Action | Method & path | Scope |
| --- | --- | --- |
| Upload a image | `POST /api/v1/items` | `image:create` |
| Read metadata | `GET /api/v1/items/:id` | `image:read` * |
| List your images | `GET /api/v1/account/items` | `image:read` |
| Delete a image | `DELETE /api/v1/items/:id` | `image:delete` |

* Reading a public image needs no key; a key, when sent, is scope-checked.

Uploads need a key (or a browser)Anonymous uploads are **browser-only** — they require a Turnstile challenge. From a script, the CLI, or an agent, send an API key with `image:create`; a keyless upload returns `403 {"error":"turnstile_failed"}`.

```
curl -sS https://ibin.co/api/v1/account/items \
  -H 'Authorization: Bearer pbca_live_…'
```

Upload capsREST accepts up to **15 MiB** per image on the API-key tier.

## pbca CLI

One CLI for the whole family. `pbca image` commands default to `ibin.co`.

| Command | What it does |
| --- | --- |
| `pbca image upload <path>` | Upload a image (returns its id + URLs) |
| `pbca image get <id-or-url>` | Print metadata as JSON |
| `pbca image list` | List your images (cursor-paginated) |
| `pbca image delete <id>` | Delete one of your images |

## MCP for AI agents

ibin.co runs a Model Context Protocol server at `https://ibin.co/mcp`, so Claude Desktop, Cursor, the MCP Inspector, and other agents can manage your images directly.

### Option A — OAuth (interactive clients)

Point your client at the MCP URL and it discovers the rest. It reads `https://ibin.co/.well-known/oauth-protected-resource/mcp`, registers with pastebin.ca (the authorization server), and runs the standard OAuth 2.1 + PKCE flow. Add to your Claude Desktop config:

```
{
  "mcpServers": {
    "imagebin": {
      "url": "https://ibin.co/mcp"
    }
  }
}
```

Config path: `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `~/.config/Claude/claude_desktop_config.json` (Linux). Cursor and Windsurf use the same `mcpServers` shape in `~/.cursor/mcp.json`. Try it live with `npx @modelcontextprotocol/inspector`.

### Option B — API-key bearer (automation)

For headless/server-side use, send a minted key directly:

```
{
  "mcpServers": {
    "imagebin": {
      "url": "https://ibin.co/mcp",
      "headers": { "Authorization": "Bearer pbca_live_…" }
    }
  }
}
```

### Tools

| Tool | Scope | Purpose |
| --- | --- | --- |
| `whoami` | — | Echo account id, scopes, audience, and token kind. |
| `get_image` | `image:read` | JSON metadata for an image (visibility-aware). |
| `list_my_images` | `image:read` | List the caller's images; cursor-paginated. |
| `upload_image` | `image:create` | Upload from base64 bytes (capped — see below). |
| `delete_image` | `image:delete` | Delete one of the caller's images. |

MCP upload capMCP uploads are capped at **6 MiB** (base64 inflates inside the JSON-RPC envelope). Use the REST endpoint for larger images.

## OAuth & DPoP

pastebin.ca is the OAuth authorization server; ibin.co is a protected resource and never mints tokens.

- OAuth tokens are **audience-bound** to `https://ibin.co/mcp` (RFC 8707) and honored only on the MCP route.
- If a key is **DPoP-bound** (RFC 9449), every MCP request must carry a matching ES256 proof; replays are rejected. Plain bearer keys work without DPoP.
- Revoke a key or connected app anytime from your pastebin.ca account.

## Discovery

Machine-readable metadata for clients and agents:

[Protected-resource metadata ↗](https://ibin.co/.well-known/oauth-protected-resource/mcp) [Authorization-server metadata ↗](https://pastebin.ca/.well-known/oauth-authorization-server) [Agent discovery (agent.json) ↗](https://ibin.co/.well-known/agent.json) [OpenAPI 3.1 document ↗](https://ibin.co/api/v1/openapi.json) [MCP endpoint (POST) ↗](https://ibin.co/mcp)


---

---
title: "Developer docs — imagebin.ca"
source: "https://ibin.co/docs/mcp"
---
Not a developer?This page is the technical guide (REST API, CLI, MCP). For how to upload, share, and use public vs private images, read the [user guide](/guide).

Documentation

# Build with ibin.co

REST API, the pbca CLI, and an MCP server for AI agents — all on your pastebin.ca account.

[Quick start](#quickstart) [REST API](#rest) [pbca CLI](#cli) [MCP for AI agents](#mcp) [OAuth & DPoP](#oauth) [Discovery](#discovery)

## Quick start

ibin.co shares your pastebin.ca account. There is nothing new to sign up for — install the CLI, mint an API key bound to this site, and you can drive everything from the terminal, your scripts, or an AI agent.

Audience-boundKeys are scoped to one site. A `image:*` key only works on `ibin.co`; it is rejected everywhere else.

**1.** Install the `pbca` CLI — a self-contained Rust binary:

```
curl -fsSL https://pastebin.ca/cli/install.sh | sh
```

Installs `pbca` to `/usr/local/bin` (override with `PBCA_INSTALL_PREFIX`). Prefer a direct download? Grab a platform binary — macOS, Linux, or Windows — from [pastebin.ca/cli](https://pastebin.ca/cli).

**2.** Mint a key bound to `ibin.co` on pastebin.ca:

```
pbca account api-key create \
  --scopes image:read,image:create,image:delete \
  --audience https://ibin.co
```

**3.** Give the key to the CLI via `PBCA_API_KEY` or `pbca account login`, then upload your first image:

```
pbca image upload ./your-image
```

## REST API

A small JSON surface. Send your key as `Authorization: Bearer <api-key>`. Anonymous browser uploads (with Turnstile) and signed-in cookie sessions also work; API-key callers must hold the matching scope.

### Scopes

image:read image:create image:delete

| Action | Method & path | Scope |
| --- | --- | --- |
| Upload a image | `POST /api/v1/items` | `image:create` |
| Read metadata | `GET /api/v1/items/:id` | `image:read` * |
| List your images | `GET /api/v1/account/items` | `image:read` |
| Delete a image | `DELETE /api/v1/items/:id` | `image:delete` |

* Reading a public image needs no key; a key, when sent, is scope-checked.

Uploads need a key (or a browser)Anonymous uploads are **browser-only** — they require a Turnstile challenge. From a script, the CLI, or an agent, send an API key with `image:create`; a keyless upload returns `403 {"error":"turnstile_failed"}`.

```
curl -sS https://ibin.co/api/v1/account/items \
  -H 'Authorization: Bearer pbca_live_…'
```

Upload capsREST accepts up to **15 MiB** per image on the API-key tier.

## pbca CLI

One CLI for the whole family. `pbca image` commands default to `ibin.co`.

| Command | What it does |
| --- | --- |
| `pbca image upload <path>` | Upload a image (returns its id + URLs) |
| `pbca image get <id-or-url>` | Print metadata as JSON |
| `pbca image list` | List your images (cursor-paginated) |
| `pbca image delete <id>` | Delete one of your images |

## MCP for AI agents

ibin.co runs a Model Context Protocol server at `https://ibin.co/mcp`, so Claude Desktop, Cursor, the MCP Inspector, and other agents can manage your images directly.

### Option A — OAuth (interactive clients)

Point your client at the MCP URL and it discovers the rest. It reads `https://ibin.co/.well-known/oauth-protected-resource/mcp`, registers with pastebin.ca (the authorization server), and runs the standard OAuth 2.1 + PKCE flow. Add to your Claude Desktop config:

```
{
  "mcpServers": {
    "imagebin": {
      "url": "https://ibin.co/mcp"
    }
  }
}
```

Config path: `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `~/.config/Claude/claude_desktop_config.json` (Linux). Cursor and Windsurf use the same `mcpServers` shape in `~/.cursor/mcp.json`. Try it live with `npx @modelcontextprotocol/inspector`.

### Option B — API-key bearer (automation)

For headless/server-side use, send a minted key directly:

```
{
  "mcpServers": {
    "imagebin": {
      "url": "https://ibin.co/mcp",
      "headers": { "Authorization": "Bearer pbca_live_…" }
    }
  }
}
```

### Tools

| Tool | Scope | Purpose |
| --- | --- | --- |
| `whoami` | — | Echo account id, scopes, audience, and token kind. |
| `get_image` | `image:read` | JSON metadata for an image (visibility-aware). |
| `list_my_images` | `image:read` | List the caller's images; cursor-paginated. |
| `upload_image` | `image:create` | Upload from base64 bytes (capped — see below). |
| `delete_image` | `image:delete` | Delete one of the caller's images. |

MCP upload capMCP uploads are capped at **6 MiB** (base64 inflates inside the JSON-RPC envelope). Use the REST endpoint for larger images.

## OAuth & DPoP

pastebin.ca is the OAuth authorization server; ibin.co is a protected resource and never mints tokens.

- OAuth tokens are **audience-bound** to `https://ibin.co/mcp` (RFC 8707) and honored only on the MCP route.
- If a key is **DPoP-bound** (RFC 9449), every MCP request must carry a matching ES256 proof; replays are rejected. Plain bearer keys work without DPoP.
- Revoke a key or connected app anytime from your pastebin.ca account.

## Discovery

Machine-readable metadata for clients and agents:

[Protected-resource metadata ↗](https://ibin.co/.well-known/oauth-protected-resource/mcp) [Authorization-server metadata ↗](https://pastebin.ca/.well-known/oauth-authorization-server) [Agent discovery (agent.json) ↗](https://ibin.co/.well-known/agent.json) [OpenAPI 3.1 document ↗](https://ibin.co/api/v1/openapi.json) [MCP endpoint (POST) ↗](https://ibin.co/mcp)


---

---
title: "How to use imagebin.ca — User guide"
source: "https://ibin.co/guide"
---
User guide

# How to use imagebin.ca

What imagebin is, how public and private images work, and step-by-step how-tos — no technical knowledge needed.

[What is imagebin?](#what) [How it works](#how) [Public vs private](#privacy) [How-to guides](#howtos) [Protect your privacy](#metadata) [Limits & file types](#limits) [Staying safe](#safety) [FAQ](#faq) [For developers](#developers)

## What is imagebin?

imagebin.ca is a free, fast image host. Drop in a picture and you get a permanent, shareable link in seconds — no account required. It’s built for sharing screenshots, photos, and graphics anywhere you can paste a link: chats, forums, issue trackers, social posts, or your own website.

imagebin is part of the bin family (alongside pastebin.ca, filebin.ca and others). If you make a free account on any of them, the same sign-in works everywhere — it simply raises your limits and keeps a tidy list of everything you’ve uploaded.

## How it works

1. **You upload an image.** Drag it onto the page, use the Choose images button, or paste from your clipboard.
2. **We store it and give you a link.** Every image gets a short, permanent address you can share.
3. **We make fast thumbnails.** When your image appears in a list or preview, we serve a small, optimised version from a global cache so pages load quickly — the full-quality original is always one click away.
4. **You share it however you like.** Copy a direct link, grab ready-made Markdown, or download the file again anytime.

Your link is permanentA shared link keeps working. (The one exception: images uploaded without an account expire automatically — see [Limits](#limits).)

## Public vs private

Every image is either **public** or **private**. This is the most important choice to understand, so here’s exactly what each one means.

Anyone can find it

Public images

- Anyone with the link can view the image.
- Once checked and marked safe, public images may appear in the [homepage gallery](/) and can be found by search engines.
- Good for: things you’re happy for the world to see — screenshots for a public bug report, art you want discovered, a photo for a forum post.

Link-only — like an unlisted page

Private images

- Private images **never** appear in the gallery and are never indexed by search engines.
- The share link includes a secret access token (the long `?s=…` part of the URL). That token *is* the key: anyone who has the full link can view the image; anyone without it gets a “not found” page.
- Good for: things meant for specific people — a receipt, a document photo, a draft you’re only sharing with a teammate.

Treat a private link like a passwordBecause the link contains the access token, share it only with people who should see the image. Anyone you forward it to can open it, and can pass it on. There’s no per-person login on a private link.

By default, new uploads are **public**. You can flip any single upload to private before you send it, or set *private by default* once in your account so every new image starts private. See [the how-tos](#howtos) below.

## How-to guides

### Upload an image

1. Go to the [homepage](/).
2. **Drag** an image file onto the drop area, use **Choose images** to browse for a file, or copy an image and **paste** it (Ctrl/⌘ + V).
3. Wait a moment while it uploads. When it’s done, your image and its links appear.

### Share your image

1. Open your image’s page (it opens automatically after upload, or click any image you own).
2. Use **Direct link** to share the image itself, **Markdown** to paste into docs/issues that support it, or **Download** to save the original file.
3. Click the *Copy* button next to a link to copy it to your clipboard.

### Make an upload private (or public)

1. Before uploading, tick **“Keep these uploads private (link-only)”** in the upload form to make that batch private.
2. Prefer it always on? Sign in, open [your account](/account), and turn on **“Make new uploads private by default.”**
3. Remember: a private link only works *with* its full `?s=…` token. Copy the whole link.

### Add a title, description, or tags

1. In the upload form, expand the details for an image and fill in a title, description, or comma-separated tags. All are optional.
2. These help you recognise images later and can add context for viewers.

### Find and manage your uploads

1. Sign in, then open [your account](/account) to see everything you’ve uploaded.
2. From there you can open any image or delete ones you no longer want.

### Delete an image

1. Open [your account](/account) and find the image.
2. Click **Delete** next to it. This removes the image and stops its link from working.

### Sign in (and why it helps)

1. Click **Sign in** in the top bar. Accounts are shared across the bin family via pastebin.ca — if you have one, use it here.
2. Signing in raises your upload limits, removes the automatic expiry on new uploads, and keeps a list of your images so you can manage them later.

## Protect your privacy

Photos often carry hidden metadata — the location where a picture was taken, camera serial numbers, timestamps, and more. imagebin lets you strip this automatically. Sign in and open [your account](/account) to choose:

| Setting | What it does |
| --- | --- |
| **Remove all metadata** | Strips every embedded tag before storing. The most private option. |
| **Remove location (GPS)** | Drops GPS coordinates (and rebuilds the rest from a safe allow-list, so unknown tags go too). |
| **Remove camera & owner serial numbers** | Keeps basic camera info (make/model/exposure) but removes serials, owner name, and GPS. |
| **Private by default** | Every new upload starts as link-only private. |
| **No AI descriptions or tags** | Opts your images out of automated captioning/tagging, and clears any that already exist. |

What we never keepimagebin does not store GPS coordinates or device serial numbers in a way that’s exposed on your image page. Location and serials shown by your camera app are stripped according to the settings above.

## Limits & file types

imagebin accepts common image formats — JPEG, PNG, GIF, WebP, and similar. Limits depend on whether you’re signed in:

|  | Anonymous | Signed in (free) |
| --- | --- | --- |
| Maximum per image | 8 MB | 15 MB |
| Total storage | — | 1 GB |
| Uploads per hour | 30 | 120 |
| Auto-expiry | Removed after 90 days | Kept until you delete |

Want bigger, permanent uploads?Create a free account (it’s the shared pastebin.ca sign-in). You get larger files, no auto-expiry, and a managed list of your images.

## Staying safe

imagebin is a shared, public-friendly service. To keep it usable for everyone:

- Only upload images you have the right to share.
- No illegal content, and nothing that sexualises minors — such material is removed and reported.
- Uploads are automatically screened, and only images checked as safe appear in the public gallery.

If you come across something that breaks these rules, please report it via the [abuse page](https://pastebin.ca/abuse).

## FAQ

**Do I need an account?** No. You can upload and share without one. An account just raises limits and keeps your images from expiring. **How long do images last?** Images uploaded while signed in stay until you delete them. Anonymous uploads are removed after 90 days. **Who can see a private image?** Only people you give the full link to. The link contains a secret token; without it, the image can’t be opened. **Can I change an image after uploading?** You can edit its title, description, and tags, and delete it. The image file itself can’t be swapped — upload a new one instead. **I lost a private link. Can you recover it?** If you were signed in, open [your account](/account) to find it again. If you uploaded anonymously, the link can’t be recovered — so save private links somewhere safe. **Can I make a public image private later (or the reverse)?** Set visibility at upload time. To change it afterwards, the simplest path is to re-upload with the visibility you want and delete the old one.

## For developers

Want to upload from a script, the terminal, or an AI agent? imagebin has a REST API, the `pbca` command-line tool, and a Model Context Protocol (MCP) server.

[Developer docs →](/docs) [REST API](/docs#rest) [CLI](/docs#cli) [MCP for agents](/docs#mcp)