Free anime APIs for browser JavaScript

Which anime APIs work from the browser

Each API got a request with Origin: https://example.com, a preflight where a browser would send one, and the same request through the free cors.dev proxy (https://proxy.cors.dev/ plus the full URL). The free proxy needs no signup and allows GET and HEAD at about 600 requests a minute per IP.

AniList: GraphQL with no key

AniList has one GraphQL endpoint, https://graphql.anilist.co: send a POST with a JSON body { query, variables }, with no key or token for public data. Responses carry Access-Control-Allow-Origin: * and the preflight answered 204, so call it directly.

Skip the proxy here. A GET returns 404, the free proxy refuses POST with 405, and a GET through it got 403 with AniList's own message "You have been manually blocked. Please come to the principal's office."

AniList's docs give 90 requests a minute, cut to 30 while the API is degraded, plus a burst limiter; on 28 October 2026 X-RateLimit-Limit said 30 and the 31st request inside a minute got 429. The 429 kept Access-Control-Allow-Origin: *, but JavaScript can read only X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, not Retry-After, so wait for the Unix time in X-RateLimit-Reset.

Every media entry also has idMal, the MyAnimeList ID (Frieren: AniList 154587, MAL 52991). Searching "frieren" with the code below, the top result had an averageScore of 91 and 28 episodes.

const query = `
  query ($search: String) {
    Page(perPage: 5) {
      media(search: $search, type: ANIME) {
        title { romaji english }
        averageScore
        episodes
        siteUrl
      }
    }
  }`;

const response = await fetch('https://graphql.anilist.co', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
  body: JSON.stringify({ query, variables: { search: 'frieren' } }),
});

// AniList exposes X-RateLimit-Reset (a Unix timestamp) to the browser, not Retry-After
if (response.status === 429) {
  const resetAt = new Date(Number(response.headers.get('X-RateLimit-Reset')) * 1000);
  throw new Error(`AniList rate limit hit, try again after ${resetAt.toLocaleTimeString()}`);
}

const { data, errors } = await response.json();
if (errors) throw new Error(errors[0].message);

for (const anime of data.Page.media) {
  console.log(anime.title.english ?? anime.title.romaji, anime.averageScore, anime.episodes, anime.siteUrl);
}

Kitsu, Shikimori and AnimeThemes

• Kitsu: JSON:API at https://kitsu.io/api/edge, Access-Control-Allow-Origin: *, no key and no rate limit in its docs. Search with filter[text]= and page with page[limit] (maximum 20) and page[offset]. JSON:API nests every field under data and attributes, so one result for "frieren" was 6,286 bytes.
• Shikimori: REST at https://shikimori.io/api (shikimori.one redirects there); /api/animes?search=frieren&limit=1 returned 512 bytes with Access-Control-Allow-Origin: *. Its docs allow 5 requests a second and 90 a minute, want your OAuth2 application name in User-Agent and warn that IPs can be banned without it, so keep anything beyond a personal page on a backend.
• AnimeThemes: opening and ending themes. Its docs mark the JSON:API at api.animethemes.moe as deprecated; use GraphQL at https://graphql.animethemes.moe/ (POST, CORS for any origin, 90 requests a minute). findAnimeByExternalSite(site: MAL, id: [52991]) returned Frieren's 4 themes, from OP "Yuusha" to OP2 "Haru".

MangaDex: the API that asks for a proxy

https://api.mangadex.org/manga?limit=1 answered 200 (5,789 bytes) with no Access-Control-Allow-Origin for example.com, and the preflight got 403: MangaDex sends CORS headers only to https://mangadex.org. Its docs say you "MUST proxy the requests your users make to our services", and they require an honest User-Agent and no Via header.

The free cors.dev proxy fits those rules. It returned the same 5,789 bytes with 200, sends User-Agent: cors.dev/0.1 (+https://cors.dev), adds no Via header, and does not pass on your page's Referer or Origin.

That matters for covers. MangaDex answers hotlinks with a placeholder: the 256 px Frieren cover requested with a Referer or Origin from another site came back as a 59,480-byte placeholder, and through cors.dev as the real 47,314-byte cover. The proxy relays images only to requests that send an Origin, so set crossOrigin = 'anonymous', or it answers 502 unsupported_response.

const PROXY = 'https://proxy.cors.dev/';
const params = new URLSearchParams({ title: 'frieren', limit: '5', 'includes[]': 'cover_art' });

const response = await fetch(`${PROXY}https://api.mangadex.org/manga?${params}`);
if (!response.ok) throw new Error(`MangaDex answered ${response.status}`);
const { data } = await response.json();

for (const manga of data) {
  const cover = manga.relationships.find((relation) => relation.type === 'cover_art');
  const img = document.createElement('img');

  // crossOrigin makes the browser send an Origin header, which the proxy requires for images
  img.crossOrigin = 'anonymous';
  img.src = `${PROXY}https://uploads.mangadex.org/covers/${manga.id}/${cover.attributes.fileName}.256.jpg`;
  img.alt = manga.attributes.title.en ?? Object.values(manga.attributes.title)[0];
  document.body.append(img);
}

Rules to plan around:

• About 5 requests a second per IP for the whole API, then 429, then a temporary 403 ban if you keep going. MangaDex warns that on a proxy or shared network other users' requests count against you, and the free proxy is shared.
• limit above 100 returns 400, and so does offset plus limit above 10,000.
• The API is free only for projects that credit MangaDex, credit scanlation groups (and honor their removal requests) if users can read chapters, and run no ads or paid services. Donations are allowed.

cors.dev Pro ($5 a month for 500,000 requests) adds little here: its X-Cors-Cache never caches longer than the upstream allows, and MangaDex sends max-age=15.

trace.moe and Anime News Network

trace.moe finds the anime, episode and timestamp for a screenshot: GET https://api.trace.moe/search?url= plus an encoded image URL returned 200 (3,752 bytes) with the AniList ID, episode, from, to and similarity, and CORS for our origin. Without a key you get 100 searches a day per IP, 1 at a time; over either limit it answers 402, and failed searches do not count.

Call it directly. Its docs tell client apps to do so, so each visitor uses their own IP's quota; through cors.dev, /me reported a Cloudflare address, so every proxy user would share one 100-search quota.

Anime News Network's encyclopedia API returns XML: https://cdn.animenewsnetwork.com/encyclopedia/api.xml?anime=4658 sent 14,455 bytes of text/xml with Access-Control-Allow-Origin: *, ready for DOMParser. It allows 1 request a second per IP (extra requests wait), and you must credit Anime News Network and link to the encyclopedia entry wherever you show its data.

MyAnimeList and Jikan

The official MyAnimeList API v2 needs an X-MAL-CLIENT-ID header, sends no CORS headers and answered the preflight with 405. The free proxy drops that header (listed in X-Cors-Dropped-Headers), so MAL answers 403. The MyAnimeList API guide covers the backend Worker and cors.dev Pro routes.

Jikan (api.jikan.moe/v4), the unofficial MyAnimeList API, needs no key and documents 60 requests a minute and 3 a second. On 28 October 2026 a direct request timed out after 15 seconds and the proxy returned 522 after 19 seconds. Until it answers again, get MyAnimeList IDs from AniList's idMal or AnimeThemes' findAnimeByExternalSite.

Good questions.