Free AI image generation APIs

Image APIs compared

On 28 October 2026 we sent a JSON POST with a test key to 13 image generation APIs from Origin: https://example.com, preceded by the OPTIONS preflight a browser sends. We checked both responses for Access-Control-Allow-Origin and then repeated each POST through https://proxy.cors.dev/.

Seven of the 13 APIs returned CORS headers on both the preflight and the response: Pollinations, Stability AI, fal.ai, Together AI, Hugging Face, Google Gemini and Leonardo. Replicate, Runway, Cloudflare Workers AI, Ideogram and Black Forest Labs are blocked in the browser, while OpenAI passes the preflight but omits CORS headers on its 401 error response.

Which image APIs answer a browser

• Pollinations: GET https://image.pollinations.ai/prompt/<prompt>?width=512&height=512&seed=7 returned 200 image/jpeg with Access-Control-Allow-Origin: * and no key.
• Stability AI: POST https://api.stability.ai/v2beta/stable-image/generate/core answered the preflight with 204, Access-Control-Allow-Origin: * and allowed Authorization, and its 401 response for a test key also carried Access-Control-Allow-Origin: * along with a JSON errors array.
• fal.ai: POST https://fal.run/fal-ai/flux/schnell and https://queue.fal.run/... echoed the origin and allowed Authorization and Content-Type.
• Together AI: POST https://api.together.xyz/v1/images/generations sent Access-Control-Allow-Origin: * on both the preflight and the 401.
• Hugging Face: https://router.huggingface.co sent Access-Control-Allow-Origin: * on the preflight and on the 401.
• Google Gemini: POST https://generativelanguage.googleapis.com/v1beta/models/gemini-3.1-flash-image:generateContent with x-goog-api-key echoed the origin on the preflight and on the 400 for a test key.
• Leonardo: POST https://cloud.leonardo.ai/api/rest/v1/generations echoed the origin and allowed Authorization.
• OpenAI: POST https://api.openai.com/v1/images/generations passed the preflight (200, Access-Control-Allow-Origin: *), but the 401 for a test key had no CORS header, so a failed call shows up in the browser as a network error with no readable body.
• Replicate: the preflight to https://api.replicate.com/v1/models/black-forest-labs/flux-schnell/predictions answered 200 without Access-Control-Allow-Origin, and the 401 had none either, so browsers block it.
• Runway: https://api.dev.runwayml.com/v1/text_to_image answered the OPTIONS preflight itself with 401 and no CORS header.
• Cloudflare Workers AI: https://api.cloudflare.com/client/v4/accounts/<id>/ai/run/@cf/black-forest-labs/flux-1-schnell answered OPTIONS with 405 and the POST without CORS headers.
• Ideogram: https://api.ideogram.ai answered the preflight with an empty Access-Control-Allow-Origin value, which browsers reject.
• Black Forest Labs: https://api.bfl.ai answered the preflight with 400 Disallowed CORS origin.

No key at all: Pollinations

GET https://image.pollinations.ai/prompt/<prompt>?width=512&height=512&seed=7 returns 200 image/jpeg with Access-Control-Allow-Origin: * and needs no API key. In our test a 512x512 image was 55,950 bytes, and a new, uncached prompt took 4.2 seconds. Without a key it allows 1 new image every 45 seconds per IP: a faster request gets 402 with a FREE_LIMIT error and a Retry-After header, while URLs that were already generated still load from cache.

An img tag can load that URL with no CORS at all, or you can fetch it as a Blob. Call it directly, no proxy needed; it also worked through https://proxy.cors.dev/.

function pollinationsUrl(prompt, { width = 512, height = 512, seed = 7 } = {}) {
  const url = new URL('https://image.pollinations.ai/prompt/' + encodeURIComponent(prompt));
  url.searchParams.set('width', width);
  url.searchParams.set('height', height);
  url.searchParams.set('seed', seed);
  return url.href;
}

// An img tag needs no CORS at all
function showImage(prompt) {
  const img = document.createElement('img');
  img.alt = prompt;
  img.src = pollinationsUrl(prompt);
  document.body.append(img);
}

// Or fetch it as a Blob: the endpoint sends Access-Control-Allow-Origin: *
async function fetchImage(prompt) {
  const res = await fetch(pollinationsUrl(prompt));
  if (!res.ok) throw new Error(`Pollinations HTTP ${res.status}`);
  return res.blob();
}

// Use one or the other: without a key, Pollinations allows 1 new image every 45 seconds per IP
showImage('a red bicycle');

image.pollinations.ai is the legacy endpoint. The current Pollinations docs point to gen.pollinations.ai, which answered 401 A valid API key is required.

Calling a CORS-enabled API with the user's key

Any API key in browser code, in a query string or a header, is visible to every visitor in DevTools. Keep your own production key on a backend; direct browser calls fit internal tools, prototypes and bring-your-own-key apps where each user pastes their own key.

Stability AI works from the browser directly, no proxy needed. Send multipart/form-data with prompt and output_format to POST https://api.stability.ai/v2beta/stable-image/generate/core with Authorization: Bearer <key> and Accept: image/*, and the response body is the image.

async function stabilityCore(prompt, userKey) {
  const form = new FormData();
  form.append('prompt', prompt);
  form.append('output_format', 'webp');

  const res = await fetch('https://api.stability.ai/v2beta/stable-image/generate/core', {
    method: 'POST',
    headers: { Authorization: `Bearer ${userKey}`, Accept: 'image/*' },
    body: form,
  });

  if (!res.ok) {
    const { errors = [] } = await res.json();
    throw new Error(`Stability HTTP ${res.status}: ${errors.join(', ')}`);
  }
  return URL.createObjectURL(await res.blob());
}

const userKey = prompt('Your Stability AI API key');
const imageUrl = await stabilityCore('a red bicycle', userKey);

Replicate, Runway and the APIs without CORS headers

Through the free https://proxy.cors.dev/ tier, every one of these POST requests answered 405 with method_not_allowed in the X-Cors-Error header: the free tier is GET and HEAD only. It also refuses Authorization and X-Api-Key headers with 400 header_not_allowed, and drops other unsupported headers, naming them in X-Cors-Dropped-Headers.

For APIs that block browsers, such as Replicate and Runway, use cors.dev Pro: $5 a month for 500,000 requests, with a 7-day trial of 1,000 requests and no card. It forwards POST, PUT, PATCH and DELETE, bodies up to 1 MiB, and Authorization, Content-Type and custom headers such as Runway's required X-Runway-Version. Responses are capped at 6 MiB within a 30-second upstream deadline, and cors.dev Pro allows 3,000 requests a minute per account and 100 in flight.

1. Sign in at cors.dev

   use Google to start the 7-day trial or cors.dev Pro.

2. Create a Connection

   list your exact page origins and the API hosts you call.

3. Send the Connection key

   pass it in the X-Cors-Key header when calling https://proxy.cors.dev/ followed by the target URL. It is a publishable identifier that only works from your registered origins; it is not a secret and does not hide your API key.

Replicate and Runway are both asynchronous: you create a job with a POST, then poll a GET until the image is ready. Runway tasks start at /v1/text_to_image and are polled at GET /v1/tasks/{id}; Replicate predictions start at /v1/models/{owner}/{name}/predictions and are polled at GET /v1/predictions/{id}.

What the free tiers buy

• Pollinations: free with no key on the legacy image.pollinations.ai host, at 1 new image every 45 seconds per IP.
• Stability AI: 25 free credits buy 8 Stable Image Core images at 3 credits each, or 3 Stable Image Ultra images at 8.
• Cloudflare Workers AI: 10,000 Neurons a day at no charge. At Cloudflare's listed rates, a FLUX.1 schnell image comes back at 1024x1024, which is four 512x512 tiles, so at the default 4 steps it uses 4 x 4.80 + 4 x 9.60 = 57.6 Neurons, about 173 images a day; past that, the Workers Paid plan charges $0.011 per 1,000 Neurons.
• Replicate: select models are free to try before billing; after that, flux-schnell is $0.003 an image.
• Hugging Face: nothing for free accounts; Hugging Face's PRO plan includes $2.00 of credits a month.
• Google Gemini: image models are not on the free tier; Nano Banana 2 (gemini-3.1-flash-image) is $0.067 per 1K image.
• fal.ai, Together AI, OpenAI and Runway: no free image credits listed, so you pay from the first image: $0.003 per megapixel for FLUX.1 schnell on fal.ai, $0.0154 per FLUX.2 dev image on Together AI, $0.02 per gen4_image_turbo image on Runway.

Good questions.