Free flight tracking API for JavaScript

Which flight API works from the browser

Each API was called on 28 October 2026 with Origin: https://example.com, as a browser sends it, then through https://proxy.cors.dev/. Five of the 9 send CORS headers that let fetch() read the response on any site, but only AirLabs and AviationStack among them have a free plan.

Free plans that work with fetch()

AirLabs (airlabs.co/api/v9) gives 1,000 queries a month for personal use, with a limited set of fields on the free plan, such as lat, lng, dir, aircraft_icao and dep_iata. The key goes in the api_key query parameter, bbox limits results to an area and _fields trims each record. Responses carry Access-Control-Allow-Origin: *.

A bad key still answered HTTP 200, with {"error":{"message":"Unknown api_key","code":"unknown_api_key"}} in the body, so check data.error rather than response.ok. Results arrive in a response array.

// AirLabs sends Access-Control-Allow-Origin: *, so fetch() works without a proxy
const params = new URLSearchParams({
  bbox: '51.3,-0.7,51.7,0.1', // south-west lat, lng, north-east lat, lng
  _fields: 'flight_iata,dep_iata,arr_iata,alt,speed',
  api_key: 'YOUR_AIRLABS_KEY', // visible in the URL and DevTools
});

const response = await fetch(`https://airlabs.co/api/v9/flights?${params}`);
const data = await response.json();

// A bad key still answers HTTP 200, with an error object in the body
if (data.error) throw new Error(`AirLabs: ${data.error.code}, ${data.error.message}`);

for (const flight of data.response) {
  console.log(`${flight.flight_iata ?? '?'} ${flight.dep_iata ?? '?'} to ${flight.arr_iata ?? '?'}, ${flight.alt} m`);
}

AviationStack (api.aviationstack.com/v1) gives 100 requests a month for non-commercial use, and its pricing page lists HTTPS and real-time flights on the free plan. The key goes in access_key, and both https:// and http:// answered with Access-Control-Allow-Origin: *, even on a 401 invalid_access_key error. Basic costs $49.99 a month for 10,000 requests and adds commercial use and historical flights.

On both services the key sits in the URL, so any visitor can copy it from DevTools and spend your monthly quota. AirLabs' paid plans start at $49 a month for 25,000 queries.

OpenSky, adsb.lol and adsb.fi in the browser

The free ADS-B feeds need no key, but none of them worked from a browser page directly, and only adsb.lol answered through cors.dev:

• OpenSky Network: Every response, preflight included, carried Access-Control-Allow-Origin: https://opensky-network.org whatever origin we sent, including http://localhost:5173 and null, so the browser blocks it on every other site. Through cors.dev it answered 522 (connection timed out) after about 20 seconds, and OpenSky's docs warn that it may block AWS and other hyperscalers.
• adsb.lol: /v2/point/51.47/-0.45/25 returned 33 aircraft near Heathrow with no Access-Control-Allow-Origin header, and its preflight answered 405. Through cors.dev it returned 200 with CORS headers in our later tests, but an earlier run got 429 with x-ratelimit-remaining: 0: proxy requests share outgoing IP addresses, and the adsb.lol API README says its rate limits change with server load.
• adsb.fi: It allows 1 request a second for personal, non-commercial use and requires a credit link to adsb.fi. It sends no CORS header, and through cors.dev it answered a Cloudflare 403.
• airplanes.live: It answered 403 with a request to email them first, directly and through cors.dev.

Call these feeds from your own server. OpenSky gives anonymous clients 400 credits a day per IP: a bounding box of up to 25 square degrees costs 1 credit, a global /states/all costs 4, and a free account raises the allowance to 4,000. Accounts use OAuth2 client credentials with 30-minute tokens, and the client secret must stay out of browser code.

FlightAware AeroAPI through cors.dev Pro

FlightAware AeroAPI (aeroapi.flightaware.com/aeroapi) takes its key in the x-apikey header. The Personal tier has no monthly minimum and covers up to $5 of query fees a month ($10 for ADS-B feeders), at 10 result sets a minute for personal or academic use. Fees are per result set of up to 15 records: GET /flights/{ident} costs $0.005, so $5 pays for 1,000 flight lookups.

AeroAPI sent no Access-Control-Allow-Origin header on its 401 response or on preflight, so the browser blocks every call. The free cors.dev proxy answered a request carrying x-apikey with 400 and X-Cors-Error: header_not_allowed. cors.dev Pro forwards the header for $5 a month and 500,000 requests, with a 7-day trial of 1,000 requests and no card:

1. Sign up

   Create an account at cors.dev/signup with Google.

2. Create a Connection

   Add your exact page origin and the target host aeroapi.flightaware.com.

3. Send both headers

   Put the Connection's publishable key in X-Cors-Key and your AeroAPI key in x-apikey.

const PROXY = 'https://proxy.cors.dev/';
const target = 'https://aeroapi.flightaware.com/aeroapi/flights/BAW117';

const response = await fetch(PROXY + target, {
  headers: {
    'X-Cors-Key': 'YOUR_CONNECTION_KEY', // publishable, works only from your registered origins
    'x-apikey': 'YOUR_AEROAPI_KEY', // visible in DevTools: internal tools and prototypes only
  },
});
const proxyError = response.headers.get('X-Cors-Error');
if (proxyError) throw new Error(`cors.dev: ${proxyError}`);
if (!response.ok) throw new Error(`AeroAPI answered ${response.status}`);

const { flights } = await response.json();
for (const flight of flights.slice(0, 3)) {
  const route = `${flight.origin?.code_iata} to ${flight.destination?.code_iata}`;
  console.log(`${flight.ident} ${route}: ${flight.status}, gate arrival ${flight.estimated_in ?? 'unknown'}`);
}

FlightAware's 10 result sets a minute still apply. The AeroAPI key stays visible in DevTools and FlightAware bills query fees past the free $5, so cors.dev Pro fits internal tools and prototypes; a public site should call AeroAPI from a backend.

Flightradar24, ADS-B Exchange and AeroDataBox

These three have no permanent free plan, but they send CORS headers, so fetch() works directly with the key visible:

• Flightradar24 API: Explorer costs $9 a month for 30,000 credits, 10 requests a minute and 30 days of history; Essential is $90 a month for 333,000 credits, and both get double credits on billing cycles that start by 31 December 2026. It takes Authorization: Bearer <token> with Accept-Version: v1 and sends Access-Control-Allow-Origin: *.
• ADS-B Exchange on RapidAPI: Basic is $10 a month for 10,000 requests, then $0.0015 a request.
• AeroDataBox: RapidAPI plans start at $8 a month, API.Market has a 7-day trial with 400 API units, and direct plans start at $19 a month for 40,000 units.

RapidAPI's gateway echoed our origin and allowed x-rapidapi-key on preflight, while the free cors.dev proxy refuses Authorization and X-RapidAPI-Key with 400 header_not_allowed, so call these APIs directly.

Limits to plan for

• AviationStack: 100 requests a month, which a widget refreshing once a minute spends in 100 minutes.
• AirLabs: 1,000 queries a month; a spent quota returns the month_limit_exceeded error code.
• FlightAware AeroAPI: 10 result sets a minute and $5 of free queries a month on Personal; Standard has a $100 monthly minimum.
• cors.dev: Free needs no signup and allows GET and HEAD at about 600 requests a minute per IP, with 6 MiB responses and a 30-second upstream deadline. cors.dev Pro allows 3,000 requests a minute per account and 100 in flight, and forwards custom headers such as x-apikey.

Good questions.