Docs / Run it yourself
Run the free tools
Turn on the public free tools, pay for them from an operator key, and keep abuse and spending in check.
The site has six free tools anyone can use without an account. Two need no data provider: the search result preview runs in the browser, and the domain age checker reads the registries' free RDAP records. The other four call YepAPI, and on a public site someone has to pay for that: the operator, with a key of their own. They are off until you set one.
Turn them on
# The API (.env)
FREE_TOOLS_YEPAPI_KEY=yep_sk_... # pays for every visitor's lookups
FREE_TOOLS_DAILY_BUDGET_USD=5 # across everyone, per UTC day
TURNSTILE_SECRET_KEY=0x... # Cloudflare Turnstile
CLIENT_IP_HEADER=cf-connecting-ip # the visitor's address, set by your edge proxy# The site (apps/web/.env)
API_URL=http://localhost:4100 # where /api/public is forwarded
NEXT_PUBLIC_TURNSTILE_SITE_KEY=0x...Use a separate YepAPI key with a small balance, so a mistake or an attack can never spend more than you put on it. The site forwards only /api/public to the API; the dashboard's API is not reachable through it.
What protects your key
Every request to a paid tool passes these checks, in this order, and stops at the first one it fails:
| Check | Refused with |
|---|---|
| JSON only, at most 16 KiB, with every field validated | 415, 413 or 400 |
| A browser on another site (an Origin other than WEB_URL) | 403 |
| In production: Turnstile and CLIENT_IP_HEADER must be configured, and the header present | 503 |
| 5 requests a minute per visitor address, across all tools | 429 with Retry-After: 60 |
| Turnstile: the token must be valid, for your site, with the action free_tool. A slow or failed check counts as a fail | 403 |
| A result someone asked for in the last 24 hours is served without spending | (cached) |
| The run’s calls and worst-case cost are reserved before any paid call: your daily budget and 6,000 calls a day overall, each tool’s own daily cap, and 40 calls a day per visitor | 503 for the budget, 429 for a visitor |
- The reservation is one database transaction, so concurrent visitors cannot overshoot the budget together.
- A failed lookup is not refunded and is cached for two minutes, so retrying a broken input does not spend again. Paid calls are never retried after a server error, since the failed attempt may already have been billed.
- Visitors see plain error messages; YepAPI's own errors go only to the server log.
- Counters and cached results are deleted once they expire, every 15 minutes.
What it costs you
| Tool | YepAPI calls | Reserved per run |
|---|---|---|
| Keyword generator | 1 (20 ideas) | $0.04 |
| Backlink checker | 2 (summary and 15 links) | $0.11 |
| Website traffic checker | 1 | $0.08 |
| Competitor keyword finder | 1 (20 keywords) | $0.04 |
| Domain age checker, search result preview | none | $0 |
With the default $5 budget, that is around 60 traffic checks a day across all visitors, fewer once cache hits are taken out. Raise FREE_TOOLS_DAILY_BUDGET_USD once you see real use.