Free web search APIs, tested

Free web search APIs compared

We tested 10 web search APIs on 28 October 2026 with Origin: https://example.com, the header a browser page sends, and read each free tier on the vendor's pricing page the same day. Four live services send the CORS headers fetch() needs: Tavily, Serper, DuckDuckGo's Instant Answer API and Google's Custom Search JSON API, which is closed to new customers.

A key in browser code, in a URL or a header, is readable by every visitor, and cors.dev does not hide it. Calling a keyed API from the page fits prototypes, internal tools and bring-your-own-key apps; a public app on your own key should call the API from a backend.

APIs that work with fetch() directly

Tavily (api.tavily.com) is built for LLM apps: 1,000 free credits a month with no card, 1 credit per basic search and 2 per advanced. With X-Tavily-Access-Mode: keyless on POST /search or /extract you need no account; a keyless search answered 200 with Access-Control-Allow-Origin: * and results holding title, url, content and score. Keyless is rate-limited: after about 30 calls from one IP we got 429 with hourly_cap_reached.

With a key, send Authorization: Bearer. A missing key, or one not starting with tvly-, got a 401 without CORS headers, so the browser reports a key problem as a CORS error.

const response = await fetch('https://api.tavily.com/search', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Tavily-Access-Mode': 'keyless',
  },
  body: JSON.stringify({ query: 'what is cors', max_results: 5 }),
});
const data = await response.json();

if (!response.ok) {
  // 429 hourly_cap_reached once the keyless allowance runs out
  throw new Error(`Tavily ${response.status}: ${data.error?.message ?? data.detail?.error}`);
}

for (const { title, url, content } of data.results) {
  console.log(title, url, content.slice(0, 120));
}

Serper (google.serper.dev) returns Google results as JSON: 2,500 free queries with no card, then credits from $50 for 50,000 queries. Its preflight answered 204 with Access-Control-Allow-Origin: * and X-API-KEY allowed, and an invalid key got a 403 with CORS headers, so the real status reaches your code.

The DuckDuckGo Instant Answer API (https://api.duckduckgo.com/?q=...&format=json) is free, needs no key and answered 200 with Access-Control-Allow-Origin: *. It returns instant answers, not web results: Heading, AbstractText, AbstractURL and RelatedTopics with Text and FirstURL. It is served as application/x-javascript, and response.json() parses it anyway.

async function instantAnswer(query) {
  const params = new URLSearchParams({ q: query, format: 'json', no_html: '1', skip_disambig: '1' });
  const response = await fetch('https://api.duckduckgo.com/?' + params);
  const data = await response.json();

  return {
    heading: data.Heading,
    abstract: data.AbstractText,
    source: data.AbstractURL,
    related: data.RelatedTopics.filter((topic) => topic.FirstURL).map(({ Text, FirstURL }) => ({
      text: Text,
      url: FirstURL,
    })),
  };
}

console.log(await instantAnswer('javascript'));

APIs that need a proxy or a backend

SerpApi (serpapi.com) sends no CORS headers: 401 without Access-Control-Allow-Origin, and 404 on OPTIONS. Its key travels in the api_key query parameter of a GET, so https://proxy.cors.dev/ forwards it as-is and returns CORS headers, with no signup, about 600 requests a minute per IP and responses up to 6 MiB. Free plan: 250 searches a month and 50 an hour; paid plans start at $25 a month for 1,000. Details in the SerpApi guide.

const params = new URLSearchParams({
  engine: 'google',
  q: 'cors proxy',
  api_key: localStorage.getItem('serpapi_key'),
});
const response = await fetch('https://proxy.cors.dev/https://serpapi.com/search.json?' + params);

const proxyError = response.headers.get('X-Cors-Error');
if (proxyError) throw new Error(`cors.dev: ${proxyError}`);

const data = await response.json();
if (data.error) throw new Error(`SerpApi ${response.status}: ${data.error}`);

for (const { position, title, link } of data.organic_results ?? []) {
  console.log(position, title, link);
}

The next three need a key header, and Exa a POST, which the free proxy refuses with 400 header_not_allowed or 405 method_not_allowed. cors.dev Pro forwards both from origins you register, for $5 a month for 500,000 requests with a 7-day, 1,000-request trial and no card; a backend works too.

• Brave Search API (api.search.brave.com): Brave's own index, $5 of credit every month at $5 per 1,000 requests, card required. The token only works in X-Subscription-Token (in the query string it got 422), and the preflight answered 405 without CORS headers.
• Exa (api.exa.ai): Search for AI, $10 of credit every month plus a $10 onboarding bonus with no payment method; search from $4 per 1,000 requests. The preflight answered 204 without Access-Control-Allow-Origin, and an invalid x-api-key got a 401 without it.
• You.com (ydc-index.io): $5 per 1,000 calls, and the pricing page lists $10 of free credit, about 2,000 searches. The key goes in X-API-Key; requests and preflights answered 403 without CORS headers.

Retired and closing: Bing and Google

Google's page says "The Custom Search JSON API is closed to new customers." Existing customers keep 100 free queries a day, then $5 per 1,000 up to 10,000 a day, until it is discontinued on 1 January 2027. It does send CORS headers, echoing the page origin even on a 400, and Google suggests Vertex AI Search for up to 50 domains.

Microsoft retired the Bing Search APIs on 11 August 2025 and points customers to Grounding with Bing Search in Azure AI Agents. api.bing.microsoft.com/v7.0/search still answered 401 with Access-Control-Allow-Origin: *, but no keys are issued.

SearXNG: free if you host it

SearXNG is open-source metasearch you host yourself, with JSON at GET /search?q=...&format=json. The public instances we tried answered with a browser-verification page or 429, and the docs warn that many disable JSON.

1. Enable JSON

   Add json under search.formats in settings.yml; the default is html only, and a disabled format returns 403.

2. Add the CORS header

   Put an Access-Control-Allow-Origin entry under server.default_http_headers, since the defaults include none.

Which one for an LLM or agent app

• Prompt-ready snippets: Tavily returns content per result, and /extract returns page text at 1 credit per 5 URLs on basic extraction.
• Search plus page text: Exa pairs search with a Contents API at $1 per 1,000 pages.
• Extracted context: Brave markets an LLM Context API that returns ranked, extracted content instead of a results page.
• Google's result structure: Serper and SerpApi return organic results plus extras such as related questions.
• Many results per call: You.com returns up to 100.

Good questions.