public-apis/public-apis has 483,000 stars, 53,000 forks and 5,600+ commits. It's MIT licensed, and it lists free APIs across 51 categories: animals, books, crypto, finance, weather, test data and more. It's the best starting point on the internet for "I want to build something but I need data."
The repo: github.com/public-apis/public-apis →
It's also badly used. People search it for something cool, find a cat-facts API, and never build anything. The value is in three columns most people skip.
What's in this guide
1. Scroll past the top first
Open the README and the first thing you see isn't the free list. It's a banner for the APILayer Unified Suite, then a table of APILayer's own products: IPstack, Marketstack, Weatherstack, Fixer, Aviationstack and others. Each has a "Run in Postman" button.
Those are commercial APIs. APILayer is a company that sells API access, and the repo's homepage link points to it. Some of those products have free tiers, but they're a sales funnel, not part of the community-curated list.
Nothing wrong with that. Maintaining a list this size costs someone something. But if you didn't know, you'd assume the first table is the "best" free APIs. It isn't. The real list starts at the Index.
2. The three columns that matter
Every entry in the list has the same five columns: name, description, and then the three that decide whether you can use it today.
| Column | What it tells you | What you want |
|---|---|---|
| Auth | Do you need to sign up for a key? | No |
| HTTPS | Is the connection encrypted? | Yes |
| CORS | Can a browser call it directly? | Yes |
Auth is the obvious one. No means you call it and get data back. apiKey means a signup, an email confirmation, sometimes a card. OAuth means an entire login flow, which is a weekend, not five minutes.
HTTPS matters more than it looks. Modern browsers block a secure page from loading insecure data. If your site is on HTTPS (it is) and the API isn't, it often won't work from the front end at all.
CORS is the one nobody explains. Browsers block a website from calling another site's API unless that API explicitly allows it. If CORS is No or Unknown, you'll hit the famous red CORS error in the console, and you'll need a small server in between. If it's Yes, a plain HTML file with ten lines of JavaScript can call it.
3. The 5-minute filter
Auth: No · HTTPS: Yes · CORS: Yes.
That combination means no signup, no server and no backend. Open a blank HTML file, call the API from the browser, and you're done. Everything in the next section passes it.
Easiest way to apply it: open the README, press Cmd/Ctrl + F and search for | No | Yes | Yes |. That string matches exactly the rows that pass all three, across every category.
| No | Yes | Yes |4. Picks worth starting with
All of these pass the filter, as listed in the README when I checked.
For learning and testing
- JSONPlaceholder: fake REST API for testing and prototyping. The default first API for a reason.
- Httpbin: echoes back whatever you send it. The fastest way to understand what a request actually contains.
- Kroki: turns text descriptions into diagrams.
For fun projects that look good
- Dogs (dog.ceo): dog photos, based on the Stanford Dogs dataset.
- HTTP Cat: a cat photo for every HTTP status code. Useful for custom error pages.
- Art Institute of Chicago: a real museum's collection data.
- PoetryDB: a large poetry collection.
- Iconify: search and fetch SVG icons from 200+ open-source icon sets.
For something actually useful
- Frankfurter: exchange rates, conversion and time series.
- CoinGecko: crypto prices, market and developer data.
- Agify, Genderize and Nationalize: estimate age, gender and nationality from a first name. Good for demos; treat the output as a guess.
5. "No auth" does not mean free
This one caught me while checking the list. The Auth column only tells you whether you need a key. It says nothing about cost.
Example from the current README: an entry called Zennet is listed with Auth: No, and its own description says "x402 pay-per-use APIs." No key, but you pay per call.
Read the description, then the API's own docs, before building on anything. Also check rate limits: "free" often means a few hundred requests a day.
Two more things worth knowing about a list this size:
- Entries go stale. The repo has around 1,900 open pull requests. Contributors add new APIs faster than anyone removes dead ones. Test an endpoint before you build a project around it.
- Newer additions vary a lot. Alongside long-running public services, there are recent entries from small projects, crypto tools and startups. That isn't bad, but "it's on the list" isn't the same as "it'll still be up next year."
6. What to actually build
An API is only useful once it's in something. Weekend-sized ideas using only filter-passing APIs:
- A currency converter with Frankfurter. One input, one dropdown, live rates.
- A custom 404 page that shows the matching HTTP Cat.
- A "museum of the day" page pulling a random artwork from the Art Institute of Chicago.
- A crypto price widget with CoinGecko.
The fastest way to build any of these: paste the API's docs link into Claude or Cursor and ask for "a single HTML file that calls this API and displays the results nicely." Because these pass the CORS filter, that file will just work, with no server or deploy step. That's the whole point of the filter.
Method note: Star, fork and commit counts, the category count, the APILayer section and every Auth/HTTPS/CORS value quoted here were read directly from the repo and its README in October 2026. Entries change constantly; test before you rely on any of them.
Want the next one first?
The Input Daily — a 5-minute AI brief every weekday. 3 stories that matter, 1 tool worth trying, 1 prompt to steal.
Free. Every morning. Unsubscribe in one click. Privacy Policy.
You're all set.
The Input Daily lands in your inbox tomorrow morning. While you're here — the rest of the guides are free too.
Browse all free guides →