What Is a Public API? Definition, Examples and How to Tell

October 26, 2026

Quick answer: A public API is an interface any developer can call without a business agreement: you read the documentation, take a key if one is required, and send requests. Most are not anonymous. Of the 1,555 public APIs we listed on 18 September 2026, 614 needed no credential and 784 a self-serve API key.

We run Public APIs, an API directory sorted into 52 categories, so we see the definition from the catalog side. Below: the definition, four live calls that show the range from fully open to locked, and a short test for telling whether an API you found is public.

What is a public API?

A public API (also called an open or external API) is published for developers outside the company that runs it. The documentation is readable without logging in, access is self-serve, and the terms apply to anyone who signs up. "Public" describes who may call it, not what it costs or whether it needs a key.

| Type | Who can call it | How you get access | Typical example | |---|---|---|---| | Public (open) | Any developer | Read the docs, take a key if needed | Weather, maps, open government data | | Partner | Approved companies | Contract or application review | Payment or airline booking integrations | | Private (internal) | The company's own teams | Internal network or service credentials | A mobile app's own backend | | Composite | Depends on the APIs it bundles | One call that fans out to several APIs | A checkout endpoint that calls inventory, pricing and payments |

The line between public and partner is the agreement. If you need a sales call, a signed contract or manual approval before your first request, the API is a partner API even when its documentation is public.

What is an example of a public API?

We called four well-known endpoints on 22 October 2026, one GET each, with no key and no login. The table shows what came back.

| Endpoint | Status | Bytes | access-control-allow-origin | x-ratelimit-limit | www-authenticate | |---|---|---|---|---|---| | Open-Meteo forecast | 200 | 321 | not sent | not sent | not sent | | GitHub /users/octocat | 200 | 1,350 | * | 60 | not sent | | NASA APOD | 403 | 129 | * | not sent | not sent | | Stripe /v1/charges | 401 | 342 | * | not sent | Basic realm="Stripe" |

Each one is public in a different way:

Keyless and open. Open-Meteo returned a 200 with the current Berlin temperature and no credential at all. Our request carried no Origin header, and the response carried no CORS header, so a browser test is the way to confirm cross-origin use.
Anonymous but metered. GitHub answered with a 200 and the public profile, and its x-ratelimit-limit: 60 header told us how much anonymous traffic it allows before asking for a token. Public, but rationed. Our rate limiting guide covers how to read those headers.
Public, key required. NASA's Astronomy Picture of the Day API returned a 403 without a key. The documentation is open and anyone can get a key, so it is still a public API; the key identifies the caller.
Public docs, private data. Stripe returned a 401 with www-authenticate: Basic realm="Stripe". Anyone can read Stripe's reference, but /v1/charges holds an account's payments, so it only answers to that account's secret key.

The first three are what most people mean by a public API. The fourth is a public interface to private data, which is why "is the documentation public?" alone does not settle the question.

Public vs private API: what is the difference?

A private API is built for the company's own clients, such as its web app, mobile app or internal services. Its endpoints may be reachable on the internet, but nobody outside is invited to build on them, the contract can change without notice, and there are no published terms for third parties.

A public API makes a promise to strangers: documented endpoints, a way to get access without asking, and some stability over time. That promise is why public APIs version their changes. GitHub, for example, selects a version through the X-GitHub-Api-Version header and supports a previous version for at least 24 months after a new one ships (GitHub docs, verified 22 October 2026). Our API versioning guide covers what builders owe their callers.

| | Public API | Private API | |---|---|---| | Intended callers | Any developer | The owner's own apps and services | | Documentation | Published, readable without login | Internal, if written down | | Access | Self-serve: none, a key, or OAuth | Internal credentials | | Change policy | Versioned, announced | Changes when the owner's apps change |

Are public APIs free?

Many are, but "public" and "free" are separate questions. Across the 1,555 published APIs in our catalog on 18 September 2026, the access split was:

| Access method | APIs | Share | |---|---|---| | No credential | 614 | 39.5% | | Static API key | 784 | 50.4% | | OAuth | 157 | 10.1% |

So about half of public APIs want a self-serve key. A key is not a paywall in itself: it lets the provider count your calls, set your quota and contact you. Price is a separate line on the provider's pricing page. Our API authentication methods post explains when providers choose a key over OAuth.

The fully frictionless group is smaller still. Of the 1,578 APIs live in the catalog on 6 October 2026, 240 (15.2%) needed no key and allowed cross-origin calls, meaning a browser page can call them directly with no backend and no signup.

How do I know if an API is public?

Four checks settle it in a few minutes:

Documentation without a sales call. The reference is readable without logging in, and the "get access" path is a signup form, not "contact us".
A self-serve credential. If you can create a key or an OAuth app yourself and use it right away, the API is public. Manual approval points to a partner API.
An anonymous request. Send one GET with no credential. A 200 means it is open to anonymous callers; headers like x-ratelimit-limit tell you the anonymous allowance.
Read the error. A 401 or 403 is not proof the API is private. NASA's 403 meant "bring a key anyone can get"; Stripe's 401 with www-authenticate meant "this data belongs to an account". Check the docs for a public key path before concluding.

Our step-by-step API testing guide shows how to send these requests and read the responses.

Where to find public APIs

The quickest route is a directory that records how each API is accessed. On Public APIs every listing states its auth method and CORS support, so you can find the keyless ones before you write a line of code. Start with all APIs, or browse the open data APIs for government and civic datasets.

The directory is built on our own open-source list on GitHub, marcelscruz/public-apis, which is a separate project from the similarly named public-apis/public-apis list. For a wider view of what the catalog contains, see the State of Public APIs 2026.

FAQ

What does it mean to have a public API?

It means a company publishes an interface that outside developers can use without a contract. The documentation is open, access is self-serve, and the provider commits to keeping the interface stable enough for others to build on.

Is a public API the same as a free API?

No. Public describes who may call the API; free describes the price. Of the 1,555 we listed on 18 September 2026, 614 needed no credential and 784 a self-serve key; whether calls cost money is set by each provider's pricing page.

Is the GitHub API public?

Yes. On 22 October 2026 its /users/octocat endpoint answered an anonymous request with a 200 and x-ratelimit-limit: 60. Endpoints that touch private repositories or act for a user need a token.

Can a public API return 401 or 403?

Yes. A 401 or 403 says this request lacks the right credential, not that the API is closed. NASA returned a 403 without a key and Stripe a 401 without one on 22 October 2026, and both publish their documentation openly.