Why YJTOON Serves Data Without Authentication

No API keys. No signup. No email. This is unusual in 2026. Here is why we did it and what we do instead.

Why no auth

• Reference data is a public good. Keys create an artificial gate.
• Agents do not have stable identities; keying by IP or User-Agent is fragile.
• The cost of serving a small JSON file is so low that billing is more expensive than the service.

What replaces auth

• Rate limits per IP and per User-Agent, with a clear 429 response and a way to ask for a higher limit.
• A static /static-data/ tree fronted by a CDN, immune to the rate limiter.
• A contact URL in the User-Agent header, which we use to whitelist known good agents.

What we give up

We cannot bill per request. We cannot personalize. We cannot lock out a misbehaving client without a clear incident. We accept that. The data is the product; the API is a courtesy.

When auth would be the right call

If we ever ship write endpoints (we currently do not), auth becomes non-negotiable. Public reads stay free.