Browser compatibility
Which free APIs can you call from the browser?
We send a real cross-origin request (Origin: https://example.com) to each API every day and record whether the CORS headers let a web page read the answer. We also log the rate-limit headers and caching policy each API sends, so you can plan around them. 24 of 25 allow it.
| API | Category | GET from page | Preflight | Rate-limit header | Cache-Control | What it means |
|---|---|---|---|---|---|---|
| Binance Ticker | Crypto | Allowed | OK | no header | no-cache, no-store, must-revalidate | Works from any web page. |
| CoinGecko | Crypto | Allowed | OK | no header | max-age=30, public, must-revalidate, s-maxage=60 | Works from any web page. |
| Coinbase Spot Price | Crypto | Allowed | OK | no header | no-store | Works from any web page. |
| Datamuse Words | Fun & media | Allowed | OK | no header | no-transform, max-age=86400 | Works from any web page. |
| Dog CEO | Fun & media | Allowed | OK | no header | no-store | Works from any web page. |
| Frankfurter FX | Finance | Allowed | OK | no header | public, max-age=86400 | Works from any web page. |
| GitHub REST | Dev tools | Allowed | OK | 60 per window (unstated) | public, max-age=60, s-maxage=60 | Works from any web page. |
| Hacker News (Firebase) | Dev tools | Allowed | OK | no header | no-cache | Works from any web page. |
| JSONPlaceholder | Dev tools | Allowed | OK | 3600000 per window (unstated) | max-age=43200 | Works from any web page. |
| Nager.Date Holidays | Open data | Allowed | OK | no header | public,max-age=604800 | Works from any web page. |
| Open Library Search | Open data | Allowed | OK | no header | none | Works from any web page. |
| Open-Meteo Forecast | Weather | Allowed | OK | no header | none | Works from any web page. |
| PokéAPI | Fun & media | Allowed | OK | no header | public, max-age=86400, s-maxage=86400 | Works from any web page. |
| PyPI JSON | Dev tools | Allowed | OK | no header | max-age=900, public | Works from any web page. |
| UK Carbon Intensity | Open data | Allowed | OK | no header | none | Works from any web page. |
| USGS Earthquakes | Open data | Allowed | OK | no header | public, max-age=60 | Works from any web page. |
| Wikipedia REST | Open data | Allowed | OK | no header | s-maxage=1209600, max-age=300 | Works from any web page. |
| httpbin | Dev tools | Allowed | OK | no header | none | Works from any web page. |
| ExchangeRate-API (open) | Finance | Allowed | Fails | no header | public, max-age=3600 | Simple GET works. Custom headers (e.g. Content-Type: application/json) may be blocked by preflight. |
| Open-Meteo Geocoding | Geocoding | Allowed | Fails | no header | public, max-age=86400 | Simple GET works. Custom headers (e.g. Content-Type: application/json) may be blocked by preflight. |
| Where the ISS at? | Open data | Allowed | Fails | 350 / 5 minutes | max-age=0, no-cache | Simple GET works. Custom headers (e.g. Content-Type: application/json) may be blocked by preflight. |
| World Bank Indicators | Open data | Allowed | Fails | no header | public, max-age=86400 | Simple GET works. Custom headers (e.g. Content-Type: application/json) may be blocked by preflight. |
| Zippopotam.us | Geocoding | Allowed | Fails | no header | max-age=14400 | Simple GET works. Custom headers (e.g. Content-Type: application/json) may be blocked by preflight. |
| npm Registry | Dev tools | Allowed | Fails | no header | max-age=300 | Simple GET works. Custom headers (e.g. Content-Type: application/json) may be blocked by preflight. |
| OpenStreetMap Nominatim | Geocoding | Blocked | OK | no header | none | Browsers will block direct calls. Use a server-side proxy. |
Last probed 2026-10-20 07:42 UTC. Raw data: /cors.json. "Preflight" is the OPTIONS request browsers send before non-simple requests.