StackExchange: 365 sites behind one endpoint, no key needed to read any of them

What it covers

StackExchange's API returns structured JSON for questions, answers, tags, and users from the whole network, not just Stack Overflow. A keyless GET /2.0/info?site=stackoverflow this week came back with Stack Overflow's own live counters: 31,467,995 total users, 24,250,299 questions, 36,112,968 answers, no signup involved.

Paging GET /2.0/sites to the end (four pages, has_more finally false) counted 365 sites total: 184 main Q&A communities and 181 meta sites that exist to govern them. That's well past the "100+ other Q&A sites" the catalogue entry's summary currently says. Worth fixing next time someone touches that line.

Auth and pricing, as they actually work

Reading is free and keyless, full stop. Every call behind this issue, site list included, went out with no key and no account. StackExchange's own auth docs are specific about what actually needs OAuth: writing anything (posting, voting, editing) and reading one user's private data. Bulk anonymous reads across the entire network are not gated behind either.

There's no paid tier on the core read API itself. The one place StackExchange does charge for more is a separate product, the Stack Overflow MCP server covered below, gated behind login with a much smaller daily cap than the REST API gets you for free.

Rate limits and CORS, confirmed live

The keyless quota showed up in the response body itself, not just the docs: our first call back this week carried quota_max: 300, quota_remaining: 294, matching the 300-requests-a-day-per-IP the catalogue entry already lists. StackExchange's throttle docs describe a second, higher ceiling for apps that register a free key without a user's OAuth token: "the max of the daily request limit for the applications involved, which by default is 10,000." That's the same 10,000-a-day figure this entry's rateLimit field carries, read straight off the docs page this session rather than assumed. A hard per-second ban sits on top of both: more than 30 requests a second from one IP gets cut off for roughly 30 seconds to a few minutes.

CORS is on. Re-running the info call with an Origin: https://greatapis.com header got access-control-allow-origin: * and access-control-allow-methods: GET, POST back, and the same headers came back with no Origin sent at all. That's not conditional on the request; it's just always on.

Why it's worth a look

The OpenAPI spec already checked into this catalogue lists 11 paths and 11 GET operations, and all four of this entry's heroEndpoints resolve directly against it: /questions, /search/advanced, /users/{ids}, /answers.

StackExchange also ships an official JavaScript SDK and, newer, a hosted MCP server at mcp.stackoverflow.com with two tools, so_search and get_content. Unlike the REST API covered above, the MCP server isn't anonymous. It needs a Stack Overflow login and caps each user at 100 calls a day, with a sales contact for anyone who needs more. Don't expect the same no-key path there that the rest of this entry gets you.