Cool Free APIs for Projects: 21 Called Without a Key

November 3, 2026

Quick answer: For a project you can start tonight, pick an API that needs no key and sends a CORS header, so a plain fetch works in the browser. On 29 October 2026, 13 of the 21 free APIs we called did both, led by PokéAPI, the Dog API and the Rick and Morty API. The Bored API did not answer.

Public APIs, a categorized directory of public APIs, notes for each listing whether it needs a key and whether browsers may call it. Of the 1,578 live APIs we listed on 6 October 2026, 240 (15.2%) needed no key and allowed cross-origin calls; the State of Public APIs 2026 report breaks that slice down by category. Keyless alone is more common: 614 of 1,555 published APIs needed no credential on 18 September 2026.

Directory flags age, so we called the famous ones. On 29 October 2026 we sent one GET to each of 21 well-known free APIs, with no key, and recorded the status, the response size and the Access-Control-Allow-Origin header.

| API | Status | Bytes | Access-Control-Allow-Origin | |---|---|---|---| | Dog API | 200 | 97 | * | | Open-Meteo | 200 | 325 | not sent | | PokéAPI | 200 | 39,636 | * | | Rick and Morty API | 200 | 2,719 | * | | SWAPI | 200 | 647 | not sent | | Spaceflight News API | 200 | 1,179 | not sent | | Open Library search | 200 | 1,860 | not sent | | REST Countries | 200 after 1 redirect | 261 | not sent | | Postcodes.io | 200 | 1,943 | * | | JokeAPI | 200 | 376 | * | | Official Joke API | 200 | 100 | * | | Chuck Norris API | 200 | 374 | not sent | | Advice Slip | 200 | 98 | * | | Cat Facts | 200 | 234 | * | | Agify | 200 | 42 | * | | country.is | 200 | 34 | * | | CoinGecko (ping) | 200 | 34 | * | | Al Quran Cloud | 200 | 1,420 | * | | VATcomply | 200 | 438 | * | | xkcd JSON | 200 | 363 | not sent | | Bored API | timed out after 30 s | n/a | n/a |

Every 200 came back as JSON. 20 of 21 answered (95%), and 13 of the 20 that answered (65%) sent Access-Control-Allow-Origin: *.

Which free APIs need no key and work from a browser?

These 13 returned 200, JSON and a wildcard CORS header without a key on 29 October 2026. We ranked them by how much a single response gives you to build on.

PokéAPI (/api/v2/pokemon/ditto). One Pokémon came back as 39,636 bytes, the largest response in the probe, which is enough for a full detail page from one call. Verdict: the best pick when a demo needs depth; cache what you fetch.
Dog API (/api/breeds/image/random). 97 bytes carrying a random dog image URL. Verdict: the smallest useful first fetch, and an image gallery in an evening.
Rick and Morty API (/api/character/1). 2,719 bytes for one character. Verdict: a well-sized record for card layouts and filters.
Postcodes.io (/postcodes/SW1A1AA). 1,943 bytes for one UK postcode. Verdict: the one real-data API in our sample that a UK-focused app can call straight from the page.
VATcomply (/rates). 438 bytes of exchange rates. Verdict: a keyless currency converter you do not have to host a backend for.
JokeAPI (/joke/Any?safe-mode). 376 bytes, with safe-mode set in the query. Verdict: the joke API to choose when strangers will see the demo.
Cat Facts (catfact.ninja/fact). 234 bytes, one fact per call. Verdict: pairs with the Dog API for a two-call pet page.
Al Quran Cloud (/v1/ayah/262). 1,420 bytes for one verse. Verdict: a real text corpus for a reader or search app.
Agify (/?name=michael). 42 bytes: an estimated age for a first name. Verdict: a playful form-input demo; label the result as a guess.
Advice Slip (/advice). 98 bytes, one line of advice. Verdict: fine for a button that changes text, little else.
Official Joke API (/random_joke). 100 bytes, served by Google Frontend. Verdict: it works, but JokeAPI gives you more control.
country.is (api.country.is/). 34 bytes: the caller's country from their IP, which from a browser means the visitor's. Verdict: a one-call localization trick.
CoinGecko (/api/v3/ping). 34 bytes. We called only the ping endpoint, so this proves the host answers keyless with CORS, not that its price endpoints do. Verdict: confirm the exact endpoint you need first.

Fun APIs for a weekend demo app

The playful half of the list is also the half that works from the browser. Dog API, Cat Facts, JokeAPI, PokéAPI and Rick and Morty all sent the wildcard header, so a static page on any free host can call them with no server at all.

Two combinations make a demo feel finished in a weekend. A pet page that shows a random dog image beside a cat fact needs two fetch calls and under 400 bytes of data. A character browser built on PokéAPI or Rick and Morty teaches search, detail views and loading states on real nested JSON. For more characters to work with, browse the anime APIs in the directory, and for fake users and orders, the test data APIs.

The Chuck Norris API answered with 374 bytes but no CORS header, so in a browser-only demo, JokeAPI is the safer joke source.

APIs that make a portfolio project look real

Real data reads better in a portfolio than jokes, and here our probe found the opposite pattern. Of the five "real data" APIs we called, only Postcodes.io sent Access-Control-Allow-Origin. Open-Meteo, Open Library, Spaceflight News and REST Countries all returned 200 and JSON, but no CORS header.

REST Countries needs a closer look. Our request for /v3.1/name/peru was redirected to a different host, files-03.restcountries.com, and came back as a 261-byte file named legacy.json. Check what that response contains before you build a country page on it.

The practical answer for this half is a small server route: your page calls your own endpoint, which calls the API and returns the result. That costs one function on a free serverless tier, and it is also the part of a portfolio project an interviewer asks about. The open data APIs in the directory are the next place to look for datasets.

Famous free APIs that no longer answer, or need a server

We included two controls on purpose. The Bored API, still recommended in many lists, did not answer: the connection timed out after 30 seconds on 29 October 2026. One timeout from one machine is not proof of a shutdown, but do not start a project on it.

The xkcd JSON endpoint answered with 363 bytes and no CORS header, as expected; it was never built for browser calls. SWAPI (swapi.dev) behaved the same way: 200, 647 bytes, no header.

One caveat applies to every "not sent" row. Our request carried no Origin header, and some servers send Access-Control-Allow-Origin only when a browser includes one. "Not sent" here means not confirmed, not blocked; the check below settles it in seconds.

How to check an API before you build on it

Three checks, in the order they cost you if you skip them:

Key. Call the endpoint with no credential. A 401 or 403 means a key, and our guide to API authentication methods explains which kind you are dealing with.
CORS. Send the request the way a browser would and read the response headers:
```
curl -sI -H 'Origin: https://example.com' 'https://api.open-meteo.com/v1/forecast?latitude=52.52&longitude=13.41&current=temperature_2m'
```
An Access-Control-Allow-Origin of * or your origin means fetch works from the page. No header means a server route.
Rate limit. Look for 429 responses and a Retry-After header before you put a public demo in front of traffic; API rate limiting covers how to back off.

A desktop client makes the first two checks faster than a terminal; our list of Postman alternatives compares the free ones.

How we called them

On 29 October 2026 at 10:33 UTC, from one machine, we sent one curl GET to each of the 21 URLs above: no key, a desktop Chrome user agent, English Accept-Language, redirects followed and a 30-second timeout. We recorded the final status, the decompressed response size, the Server and Content-Type headers and Access-Control-Allow-Origin. No Origin header was sent. Each API was called once, so a single slow or failed response may be transient.

FAQ

What are some fun free APIs to build a demo app with?

PokéAPI, the Dog API, the Rick and Morty API, JokeAPI and Cat Facts all returned JSON without a key and with a wildcard CORS header on 29 October 2026. Any of them works from a static page with a plain fetch.

Which free API needs no authentication and works straight from the browser?

The Dog API is the simplest: 97 bytes, no key and Access-Control-Allow-Origin: * in our probe. Across our directory, 240 of 1,578 live APIs needed no key and sent a CORS header on 6 October 2026.

What free APIs can I use for a portfolio project?

Open-Meteo, Open Library, Spaceflight News and Postcodes.io all returned real data without a key on 29 October 2026. Only Postcodes.io sent a CORS header, so plan a small server route for the rest.

Is the Bored API still working?

Not from our machine: on 29 October 2026 the request to boredapi.com timed out after 30 seconds. That was a single call, but it matches the API's reputation, so pick another source for activity ideas.