Developers

AOD Note API

Create and read one-time notes from scripts. Encrypt on your side with AES-256-GCM; the server only ever stores ciphertext.

Endpoints

Request	Purpose
`POST /api/v1/notes`	Create a note. JSON: `ct, iv, chk, civ` (base64url), `ttl` (60 to 2592000 s), `views` (1 to 5), `pp` (bool), `salt` (22 chars, when `pp`). Returns `id, expires_at, delete_token`.
`GET /api/v1/notes/{id}`	Check a note without opening it: `pp, salt, chk, civ, views_left, expires_at`.
`POST /api/v1/notes/{id}/read`	Open a note. Returns `ct, iv, pp, salt, views_left` and counts one view (deleted at zero).
`POST /api/v1/notes/{id}/delete`	Delete early with header `X-Delete-Token`, or with the API key that created it. (`DELETE /api/v1/notes/{id}` is accepted too, but some networks and servers filter that method.)
`GET /api/v1/health`	Service status.

Keys and limits

Anonymous creation (no API key) is limited per network and requires a Cloudflare Turnstile token in cf_token, so scripts should use an API key, which skips the check. API keys (Authorization: Bearer an_...) get higher limits; contact Admin on Demand. Notes are limited to about 250 KB.

Link format

https://aodnote.com/n/{id}#{key}

{key} is the 32-byte random key in base64url. It stays after the # and is never sent to the server. With a passphrase, the AES key is SHA-256(key || PBKDF2-SHA256(passphrase, salt, 310000 iterations, 32 bytes)). chk is the text aodnote-v1 encrypted under the same key so clients can verify a passphrase before opening (and burning) a note.