API Docs

For automation, scripts, or CI — use audityxe-cli instead of this REST API. It's the same audit engine, running on your own machine — free, genuinely unlimited, no account and no rate limit. This REST API is what the website's own UI calls, documented here for transparency, and it's subject to the same per-plan daily limits as the site itself.

POST /api/audit

Runs a full audit and returns the complete scored result. Full machine-readable spec: openapi.yaml.

Authentication

No Authorization header — treated as an anonymous visitor: 1 free audit per IP per calendar day (UTC).
Authorization: Bearer <Firebase ID token> — uses that account's plan limit instead. This is a Firebase ID token obtained by signing in through the Firebase client SDK, not a conventional static API key — there's no separate key-issuance flow. Tokens expire in about an hour and need refreshing through Firebase, which is straightforward from a browser but extra work from a plain script.
A cross-site browser request is rejected with 403 — CSRF protection for browser clients specifically, not a block on server-side/script callers, which typically don't send an Origin header at all.

Request body

{
  "url": "https://example.com",        // required
  "competitorUrl": "https://...",      // Standard/Pro only, ignored otherwise
  "confirmPageSpeed": true,            // Pro only — opt-in real Lighthouse pass
  "crawlMode": "fast" | "deep"         // default "fast"
}

Example

curl -X POST https://audityxe.vercel.app/api/audit \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

Response

The full AuditResult object (score, categories, every module and finding, fixes) plus:

_usage — your remaining quota after this request: { used, limit, remaining, plan }
pageSpeedLockReason — present when the Lighthouse pass wasn't run: "not_confirmed" or "weekly_limit"

Status codes

200	Audit completed
400	Invalid request (missing/malformed URL, oversized body)
401	Invalid or expired Firebase ID token
403	Cross-site request rejected, or automated-traffic pattern detected
429	Daily/weekly quota exhausted
502	The audit itself failed (target site unreachable, timed out)

Prefer automation without any auth or rate limit at all? See audityxe-cli and the GitHub Action.