Free public APIs that work from the browser

How the APIs were tested

We requested each example URL with an Origin header, the way a browser does, and recorded the Access-Control-Allow-Origin header of the response. Then we requested the same URL through https://proxy.cors.dev/. Sizes are the decoded response bodies of the example URL. The "From the browser" column says how to call each API from a page:

• Direct: the API sends Access-Control-Allow-Origin, so fetch(url) works from any origin with no proxy.
• Direct only: the API sends the header, but answered 400, 403 or 429 through the proxy because it blocks or rate-limits shared server IPs. Call it directly, so requests come from the visitor's own IP address.
• Via proxy: the API sends no CORS header, so a direct fetch() fails with a CORS error. Prefix the URL with https://proxy.cors.dev/.

Gutendex and the Fake Store API sent a 403 challenge page to our servers and to the proxy, and normal JSON with Access-Control-Allow-Origin: * to a residential connection, which is what a visitor's browser uses.

Weather and earth APIs

Geo, IP and time APIs

IP lookup APIs report the address that sent the request, so always call them directly: through a proxy they report the proxy server's address instead of your visitor's. Nominatim's usage policy allows at most 1 request per second, so geocode on demand and cache the result.

Reference, books and media APIs

arXiv answers with Atom XML; the arXiv API guide shows how to search papers and parse the feed in the browser. For music, books, films and archived pages, see the Deezer API guide, Goodreads shelves as RSS, the Letterboxd diary feed and the Wayback Machine API.

Free APIs for testing and fun

For test data, JSONPlaceholder serves placeholder /posts, /users and /todos, DummyJSON adds /products, /users and /carts, and Reqres returns sample users. All three send the CORS header, so they work from localhost and from a deployed page alike.

Sports and games APIs

The NHL API guide covers scores, standings and schedules, and the Steam API guide lists which Steam endpoints need no key. The ESPN API guide shows which ESPN endpoints work with a direct fetch(), and the Fantasy Premier League API guide covers live points, fixtures and mini-league tables.

Finance and crypto APIs

Frankfurter and the jsDelivr currency API return daily rates with a date field, not live quotes. For stock prices and history, see the Yahoo Finance API guide. For exchange tickers, the crypto price API guide tests 29 crypto APIs for CORS, including WebSocket feeds.

Developer and package registry APIs

The GitHub REST API sends Access-Control-Allow-Origin: * and allows 60 unauthenticated requests per hour per IP address. Through a shared proxy IP that budget is spent by other users, which is why the proxy got 403. Why GitHub says rate limit exceeded covers the details.

News and feed APIs

More on these: the Hacker News API and RSS feeds, 27 news RSS feeds that need no key, YouTube channel feeds and the Bing image of the day API.

Call each API the right way

Send APIs that allow browser calls straight to the API, and add the proxy prefix only for the hosts that need it. The proxy keeps the path and query string, so the URL after the prefix is the same one you would call directly.

// Runs in a module script or the DevTools console
const PROXY = 'https://proxy.cors.dev/';
const NEEDS_PROXY = new Set(['xkcd.com', 'api.deezer.com', 'api-web.nhle.com', 'export.arxiv.org']);

async function getJson(url) {
  const { hostname } = new URL(url);
  const response = await fetch(NEEDS_PROXY.has(hostname) ? PROXY + url : url, { credentials: 'omit' });
  if (!response.ok) {
    throw new Error(`${hostname}: ${response.headers.get('X-Cors-Error') ?? response.status}`);
  }
  return response.json();
}

const [weather, pokemon, comic, songs] = await Promise.all([
  getJson('https://api.open-meteo.com/v1/forecast?latitude=52.37&longitude=4.89&current=temperature_2m'),
  getJson('https://pokeapi.co/api/v2/pokemon/pikachu'),
  getJson('https://xkcd.com/info.0.json'),
  getJson('https://api.deezer.com/search?q=daft%20punk&limit=3'),
]);

console.log(`${weather.current.temperature_2m}${weather.current_units.temperature_2m} in Amsterdam`);
console.log(pokemon.name, pokemon.types.map((slot) => slot.type.name).join(', '));
console.log(`xkcd ${comic.num}: ${comic.safe_title}`, comic.img);
console.log(songs.data.map((song) => `${song.title} by ${song.artist.name}`));

When a proxied request fails, cors.dev names the reason in the X-Cors-Error response header, for example response_too_large or upstream_timeout, and the code puts it in the error message. Errors from the API itself, such as 404 or 429, pass through with their own status. To check an API that is not listed here, look for the CORS header yourself:

# access-control-allow-origin: * means fetch() works from any page, no proxy needed
curl -s -o /dev/null -D - -H 'Origin: https://example.com' \
  'https://pokeapi.co/api/v2/pokemon/pikachu' | grep -i access-control-allow-origin

# No output: xkcd sends no CORS header, so browser code needs the proxy prefix
curl -s -o /dev/null -D - -H 'Origin: https://example.com' \
  'https://xkcd.com/info.0.json' | grep -i access-control-allow-origin

Free APIs that do not work from a browser

These APIs appear in many free API lists but failed from browser JavaScript in our test. Most were down, need a key, use plain HTTP or block requests from servers.

Responses over 1 MiB, like the Fantasy Premier League bootstrap file, work on Pro, which relays any content type up to 6 MiB for $5 per month.

Proxy limits

• Free tier: GET and HEAD with no signup or key, 600 requests per minute per client IP from a shared pool, and no daily or monthly quota.
• Responses: text only (JSON, XML, HTML, CSV, plain text, JavaScript and SVG) up to 1 MiB, and the API gets 10 seconds to answer. Larger bodies return 502 response_too_large, images and other binary bodies 502 unsupported_response, slow APIs 504 upstream_timeout.
• Request headers: only Accept, If-None-Match and If-Modified-Since reach the API; Authorization and custom headers such as X-Api-Key return 400 header_not_allowed. HTTPS targets only, and API keys in the URL are refused.
• [Pro](/pricing): $5 per month for 500,000 requests per billing period, with a 7-day trial of 1,000 requests and no card. Adds POST, PUT, PATCH and DELETE, Authorization and custom headers, keys in the URL and any content type up to 6 MiB.
• API keys: a secret key in browser code is visible to anyone who opens DevTools, and cors.dev never stores or adds keys for you. Keep secret keys on a server or Worker.

Good questions.