Kitsu vs MangaDex

Kitsu's JSON:API-flavored REST endpoint at kitsu.io/api/edge was confirmed live with an unauthenticated anime listing and an explicit Access-Control-Allow-Origin: * header. Reading the catalog needs no account at all; OAuth is only required for actions tied to a user's own library, and the API itself carries no paid tier.

MangaDex's API was reconfirmed live at api.mangadex.org with a real manga listing, but a direct cross-origin GET and an OPTIONS preflight both came back without an Access-Control-Allow-Origin header, so browser-based CORS calls fail — corrected to no. Authentication was also corrected from a bare API key to MangaDex's real scheme: OAuth 2 personal clients using a password grant tied to a user's account, since MangaDex has no API-key concept — public reads need no auth at all. The API and its manga remain entirely free, funded by the site rather than gated behind the API.