AniList vs MangaDex

AniList's public GraphQL endpoint at graphql.anilist.co answers anime, manga, and character queries with no authentication at all — confirmed live with an unauthenticated POST that returned a normal GraphQL error payload alongside a wide-open Access-Control-Allow-Origin: * header. OAuth only comes into play for account-scoped actions like updating a user's list; browsing the catalog is free and unmetered beyond a per-minute rate limit.

MangaDex's API was reconfirmed live at api.mangadex.org with a real manga listing, but a direct cross-origin GET and an OPTIONS preflight both came back without an Access-Control-Allow-Origin header, so browser-based CORS calls fail — corrected to no. Authentication was also corrected from a bare API key to MangaDex's real scheme: OAuth 2 personal clients using a password grant tied to a user's account, since MangaDex has no API-key concept — public reads need no auth at all. The API and its manga remain entirely free, funded by the site rather than gated behind the API.