A starting point for anyone looking for real data to build with: how to evaluate a public API, and five that are well documented and easy to call from the browser.
5 APIs covered
Sample requests
Limits documented
The APIs covered on this page
Endpoints, free tiers and rate limits change. Everything here reflects the published documentation at the time of writing - always confirm on the provider's own docs before you depend on it in production.
Finding an API that returns the data you want is the easy part. Choosing one you can still depend on in six months takes a few more minutes and saves a great deal of rework.
What "public API" actually means
A public API is one anyone can call without a commercial agreement. That covers a wide range: some need no credentials at all, some need a free key, and some are free up to a quota and paid beyond it. The label says nothing about reliability, and it says nothing about whether the terms will be the same next year. Several well-known "free" APIs have introduced keys or paid tiers at short notice, which is why the evaluation below matters more than the list.
The checks worth doing before you build
1Read the terms, not the marketing. Look for the rate limit, the commercial-use clause and the attribution requirement.
2Check CORS. If the API does not send the right headers, you cannot call it from browser JavaScript and will need a server or proxy.
3Find out who runs it. A government agency, a funded company and a weekend project have very different life expectancies.
4Look for a changelog or version in the URL. Versioned endpoints signal a team that plans for change.
5Send a real request before writing any code. curl or a browser tab tells you more in thirty seconds than the documentation does in ten minutes.
Authentication patterns you will meet
Common API authentication approaches
Pattern
How it works
Watch out for
No auth
Call the URL directly
Usually the tightest rate limits
API key in query string
Append ?key=... to the URL
The key is visible in logs and browser history
API key in header
Send an Authorization or X-API-Key header
Still must never sit in front-end code
OAuth 2.0
Exchange credentials for a short-lived token
Needs a server component and token refresh handling
Rate limits and how to live within them
Most free tiers are generous for development and tight for production. Cache aggressively - exchange rates that update daily do not need to be fetched on every page view. Debounce anything driven by typing. Batch requests where the API supports it. And handle the 429 response properly: read the Retry-After header, back off exponentially, and show your users something sensible rather than a blank screen.
Building a thin server-side cache in front of a public API is usually a couple of hours of work and turns a fragile integration into a stable one. It also means an outage upstream degrades your app rather than breaking it.
Handling failure as a first-class case
Always set a timeout. A hanging request is worse than a failed one.
Distinguish between a network error, a 4xx you caused and a 5xx the provider caused - the fixes are different.
Show stale cached data with a timestamp rather than nothing at all.
Log failures with enough context to reproduce, but never log the key.
What is the difference between a public API and a free API?
Public means anyone can sign up and call it. Free refers to price, which may apply only up to a quota. Plenty of public APIs are free for development and paid for commercial volume.
Why does my API call work in curl but fail in the browser?
Almost always CORS. The browser blocks cross-origin requests unless the API sends permissive headers, so you need a server-side route to make the call on your behalf.