StockliOpen app →
Developers

Developers

What our JSON endpoints are for, how access is controlled, and where to go for structured, crawlable content.

Last updated 25 August 2026

Overview

Stockli is a web app, not a public API product. The JSON routes under /api/* exist to power the site itself.

Every price, index, fund, and fundamentals figure you see in the app is also reachable as plain HTML on a public page — those pages are what we recommend reading programmatically. See llms.txt for a structured index of public pages, and sitemap.xml for the full crawlable list.

Access model

JSON endpoints are gated to the browser session that requested the page, not open for third-party or automated callers.

  • Requests must carry a same-site session signal issued when a real page loads first — there is no API key you can request for direct JSON access today.
  • Automated traffic without that signal is challenged or rejected before it reaches application code.
  • This protects the underlying market and fund data providers, some of whom license data to us on terms that do not allow open redistribution.

Prefer the HTML pages

If you're building a tool or agent that needs Stockli data, read the public pages listed in llms.txt instead of the JSON routes — they carry the same figures and are meant to be fetched externally.

Rate limits

Both pages and API routes are rate-limited per client, tuned for normal browsing rather than bulk fetching.

  • Page loads: roughly 240 requests/minute for guests, 480/minute for signed-in sessions.
  • JSON routes: roughly 90 requests/minute for guests, 180/minute for signed-in sessions, with tighter limits on a few high-cost routes (search, news, quote polling).
  • Exceeding a limit returns HTTP 429 with a Retry-After header naming the wait in seconds.

Authentication

Accounts use Supabase Auth. There is no separate API authentication scheme — signing in only unlocks personal data (portfolios, watchlists, alerts) inside the app.

  • Email + password, or Google OAuth, both handled by Supabase Auth.
  • Signed-in sessions get the higher rate-limit tier above but no additional API surface — personal endpoints (portfolio, watchlist) require the account to be your own.

Webhooks & MCP

Webhooks

Not offered yet. Price and dividend alerts are delivered as in-app and browser push notifications only.

MCP server

Not offered. AI agents should read the public pages indexed in llms.txt.

Data & partnership requests

Want licensed, higher-volume, or programmatic access?

Email [email protected] describing your use case. We evaluate data-licensing and partnership requests case by case.