Skip to content
Indexing 1.24M Create your free library

OpenLib API · v3

The programmatic front door to 1.2M+ open-source packages.

Curlable REST endpoints, ranked by production usage. Average query returns in 180ms across the full catalog. 9.4M requests/day, 99.97% uptime over the trailing 12 months.

Create your free library Browse the index

Indexing 1,247,392 packages · updated 12s ago

GET /v3/search?q=rate+limiter
›rate limiter middleware
  • 01
    express-rate-limitMIT
    94
  • 02
    rate-limiter-flexibleMIT
    91
  • 03
    bottleneckMIT
    88
  • 04
    async-ratelimiterMIT
    79
  • 05
    p-limitMIT
    74

180ms · 5 results · ranked by Production Readiness Index

§1 — Authentication & rate limits

Two questions, answered first.

Every API buyer asks the same thing: how do I authenticate, and what are the limits. Here are the numbers — no marketing language.

Authentication

Pass your API key as a bearer token in the Authorization header on every request. Keys are issued from the dashboard and can be scoped per-environment (dev, staging, prod) and per-IP.

curl https://api.openlib.net/v3/search \
  -H "Authorization: Bearer ol_live_3f8b…"

Pro accounts can additionally restrict keys to specific endpoints and rotate them without downtime via dual-key issuance.

  • Free tier: 1 key, public endpoints only
  • Pro tier: unlimited keys, private package mirroring enabled
  • Enterprise: SAML SSO, audit log export, custom key policies

Rate limits & performance

The API is built to be called from CI, from cron jobs, and from production request paths. Limits are generous, and we publish the numbers so you can plan capacity.

1,000req / min · free
20,000req / min · pro
180msp50 latency
99.97%uptime · 12mo
9.4Mrequests served / day
15 minCVE feed refresh (not real-time)

429 responses include a Retry-After header. Bursts are tolerated up to 2× the per-minute cap; sustained overages return 429, never a billable overage.

§2 — Endpoint reference

The six endpoints you will actually call.

Every endpoint is RESTful, returns JSON, and supports cursor pagination. Base URL: https://api.openlib.net/v3

MethodPathPurpose
GET /search Full-text + faceted search across the 1.2M-package index. Filter by ecosystem, license, score, last release. GET /packages/{id} Resolve a single package by canonical id (npm:express, pypi:requests) and return its full record. GET /packages/{id}/score Return the Production Readiness Index breakdown: download velocity, issue half-life, bus-factor, CVE history. GET /packages/{id}/alternatives List ranked alternatives within the same problem space, useful for migration planning. POST /license-audit Submit an SBOM and receive a per-package license audit compatible with corporate legal workflows. GET /cve/alerts Stream CVE alerts touching your watched packages. Refreshed every 15 minutes — not real-time.

All endpoints support ?include= for related resources and ?fields= for sparse fieldsets. SDKs for JS, Python, and Go follow the same parameter names.

§3 — Working examples

The same call, in four languages.

Copy any block into your terminal. Every example returns the same five results for q=rate-limiter, scoped to npm.

curlGET /v3/search
curl "https://api.openlib.net/v3/search?q=rate-limiter&ecosystem=npm" \
  -H "Authorization: Bearer $OPENLIB_KEY"
200 OK · 180ms · 5 results
JavaScript@openlib/sdk
import { OpenLib } from "@openlib/sdk";

const ol = new OpenLib({ apiKey: process.env.OPENLIB_KEY });
const { data } = await ol.search({
  q: "rate-limiter",
  ecosystem: "npm",
  limit: 5,
});
TypeScript types included · ESM + CJS
Pythonopenlib · pip
from openlib import Client

ol = Client(api_key="ol_live_…")
results = ol.search(
    q="rate-limiter",
    ecosystem="npm",
    limit=5,
)
3.9+ · sync & async clients
Gogithub.com/openlib/go-sdk
package main

import "github.com/openlib/go-sdk"

func main() {
    client := openlib.New("ol_live_…")
    res, _ := client.Search(ctx, openlib.Query{
        Q: "rate-limiter", Ecosystem: "npm",
    })
}
go 1.21+ · context-aware
Developer workstation running the OpenLib API in a dark-themed editor

fig. 01 — SDK integration in a real IDE · 180ms round-trip on the /search endpoint

§4 — For procurement & engineering leads

Questions that gate a paid API contract.

  • What SLA do you offer on the public API?

    Pro accounts get a 99.9% monthly uptime SLA with service credits; Enterprise contracts lift this to 99.95% with named incident response. We have held 99.97% uptime over the trailing 12 months and publish live status at status.openlib.net.

  • Can we use the API data commercially in our own product?

    Yes. API responses are licensed for use inside your own product and tooling. The full catalog is additionally available as a bulk Parquet export under CC-BY-SA 4.0 — the same license terms apply whether you call the API or download the export.

  • Do you offer official SDKs?

    Yes — JavaScript / TypeScript (@openlib/sdk), Python (openlib on PyPI), and Go (github.com/openlib/go-sdk). All three are generated from the same OpenAPI spec and versioned against the API. Community SDKs exist for Ruby, Rust, and Java.

  • How do enterprise procurement and security reviews work?

    We complete vendor security questionnaires (CAIQ, SIG Lite) within five business days. SOC 2 Type I is current; Type II is in observation period. DPA available on request. Legal & security teams at 40+ Fortune 500 companies already run the API in production.

Ready when you are

Stop guessing which dependency to trust.

Build a free library, follow the packages your team uses, and call the API against your own shortlist in under five minutes.

Create your free library Compare Pro pricing →

No credit card · 380,000+ developers already onboard · Free tier keeps unlimited public collections