Limits and keys

Everloot's data is open. You do not need an account or a key to read it. There are rate limits, but no sign-in wall.

Limits#

• Asking questions needs no key. The MCP server and the market prices answer 200 requests per hour for each IP address.
• Copying in bulk does. Without a key, the corpus API and the drop list answer 30 requests per hour for each IP address, 500 records a page.
• A free key raises that to 2,000 requests per hour for your account, across all its keys and every endpoint, 5,000 records a page.
• Over a limit you get 429, a retry-after header in seconds and a message that points here.
• The site's pages have none of these limits. Search engines and AI assistants are welcome to read and quote them.

Send a key#

Put the key in an Authorization header as a bearer token. Keys start with evl_. The same header works on the MCP endpoint, and a self-hosted MCP server reads the key from EVERLOOT_API_KEY.

curl "https://everloot.app/api/corpus/public?limit=1000" \
  -H "Authorization: Bearer $EVERLOOT_API_KEY"

const res = await fetch("https://everloot.app/api/corpus/public?limit=1000", {
  headers: { Authorization: `Bearer ${process.env.EVERLOOT_API_KEY}` },
});
console.log(res.status, (await res.json()).total);

import os, requests

res = requests.get(
    "https://everloot.app/api/corpus/public",
    params={"limit": 1000},
    headers={"Authorization": f"Bearer {os.environ['EVERLOOT_API_KEY']}"},
)
print(res.status_code, res.json()["total"])

A key that is not valid or was revoked gets 401. Keep keys out of web pages and public repositories: a key in a browser can be read by anyone who opens it.

About keys#

• A key belongs to your Battle.net account, and we count requests per key. That is how we know who copies the data in bulk, so we can ask what they are building.
• You can hold 5 keys, make up to 10 a day, and revoke or delete any of them below.
• We revoke a key that is used to republish the data without credit.
• We keep a key's daily request counts for 90 days. A revoked key and its counts are deleted 30 days after it was revoked, or at once when you delete it. To delete your account and everything tied to it, write to hello@everloot.app.

Your keys#

Checking your account…

MCP server limits#

• 200 requests per hour for each IP address. Every call counts, including the handshake and the tool list.
• Over the limit you get 429 and a retry-after header, in seconds.
• All callers share one hourly cap, which uploads count against too. When it is used up, everyone gets the same 429.
• Only POST requests count. GET and OPTIONS are not counted.
• Requests larger than 1 MiB are refused.
• A free key raises the limit to 2,000 requests per hour.
• Web pages in a browser can call it only from a short list of AI sites, such as chatgpt.com and claude.ai. Servers, scripts and desktop clients are not affected.