Open Brewery DB is free and keyless, but its own homepage is wrong about rate limits

What it covers

Open Brewery DB is a free directory of breweries, cideries, and bottle shops. A client can search it by name, city, state, or brewery type. A live GET to https://api.openbrewerydb.org/v1/breweries/meta this session returned total: 11822, the full count behind the catalogue, broken down by country: 8224 in the United States, 1445 in Germany, 514 in Australia, 478 in Belgium, 283 in Canada, and smaller counts across 18 other countries.

Three more calls returned real records this session. GET /v1/breweries?per_page=1 returned one brewery in Kronach, Germany. GET /v1/breweries/search?query=dog returned 50 matches, including Dog & Pony Alehouse and Grill in Renton, Washington. GET /v1/breweries/random returned one brewery picked at random. All three came back with no key and no login needed.

Auth and pricing, as they actually work

No key. No sign-up. No login. Every call this session went out with no credentials and came back with real data, matching the auth: None already on file for this entry.

There is no paid tier either. The project's own homepage states this outright: 'Query our developer-friendly JSON API. No sign-ups, API keys, or rate limits.' The free, keyless part checks out. This session confirmed it on every call. The rate limit part does not check out, as the next section shows from the same session's response headers.

Rate limits and CORS, confirmed live

Every response this session carried an x-ratelimit-limit: 120 header. The remaining count fell as the calls went out: 119 on the first probe, then 112, 111, and 110 across the calls that followed. The homepage says there are no rate limits. The header on every single response says there is a real ceiling of 120, counted per request, and it does not disclose the window it resets on.

CORS is on. A GET to /v1/breweries/meta sent with Origin: https://greatapis.com got that exact origin echoed straight back in access-control-allow-origin, plus access-control-allow-credentials: true, confirming a browser can call this API directly from client-side code. The API sits behind Cloudflare: the meta response carried cache-control: max-age=300 and cf-cache-status: BYPASS, so this session's probe reached the origin server rather than a cached edge copy.

Why it's worth a look

Open Brewery DB is a clean, well-populated directory with no signup friction. Anyone building a beer-finder app, a brewery map, or a small side project gets a real dataset of nearly 12,000 venues on the first call.

The catch is that the limit is real even though the homepage says it is not. A client that fires off requests in a loop, trusting that claim, will eventually hit a wall the homepage never mentioned. The response headers, not the homepage text, are the only place that wall is documented.