Social Media APIs by Platform: What's Official, What It Costs, and What's Public Without a Key

Every major social platform has an official API. Only four of them will read public data about an account that never authorised your app without a review, a partnership or a bill: YouTube, Bluesky, Twitch and, at a per-read price, X. Instagram, Facebook, Threads, TikTok, Reddit, LinkedIn and Pinterest all gate that kind of read behind App Review, a partner programme, research accreditation, or an approval queue, and several of them do not offer it to commercial developers at all.

Every official-API fact below was checked against the platform's own documentation on 2026-09-25, with links at the end.

Which social media platforms have an API, and what do they cost?

Platform	Official read API	Approval before you can read other accounts	Published price	What a logged-out request still returns
YouTube	YouTube Data API v3	None, an API key is enough	No per-call fee; 10,000 quota units a day	Channel RSS with views and likes, oEmbed, watch pages
Bluesky	AT Protocol, public AppView	None, no key at all	Free	Everything public, as JSON, callable from a browser
Twitch	Helix	None, a free app token covers public data	No published fee	Nothing from the API; a token is mandatory
X / Twitter	X API v2	None	$0.005 per post read, $0.010 per user read	Single posts through the embed service; a profile's counts and latest few posts
Threads	Threads API	App Review for profile discovery and keyword search	Free	Client-rendered pages with no post text in the HTML
Instagram	Instagram API (two login flavours)	App Review; other accounts only via business discovery	Free	The profile page shell; the JSON endpoints refuse logged-out callers
Facebook	Graph API	App Review and business verification for Page public content	Free	Public Pages render for browsers; plain requests are often refused
TikTok	Display, Research, Commercial Content APIs	Research API is for accredited non-commercial researchers only	No published fee	oEmbed; public video pages with rounded counts
Reddit	Reddit Data API	Registered OAuth client, access by request	Free tier at 100 queries a minute; commercial by agreement	RSS feeds of posts without vote or comment counts; JSON routes return 403
LinkedIn	LinkedIn API	Partner programmes for anything beyond sign-in and sharing	By partner agreement	Company pages with name and follower count; search asks you to sign in
Pinterest	Pinterest API v5	Trial access, then Standard access by video demo	No published fee	RSS feeds of a user's or board's recent Pins

Two columns in that table are worth reading carefully before you plan anything.

"Approval" is the column that kills projects, not "price". Most of these APIs are free. What they will not do is read an arbitrary account: the official Instagram, Pinterest and TikTok Display APIs read accounts that logged in to your app, and nothing else at any price.

The last column is a snapshot, not a promise. It records what a plain, logged-out HTTP request received in September 2026. None of those surfaces is a documented data API, and all of them change without notice. Read the contract question it raises before you build on it.

YouTube: the most open official API in the category

The YouTube Data API needs a Google Cloud project and an API key, and nothing else. No review, no partnership, and no per-call price. The limit is quota, and Google publishes it exactly:

"Projects that enable the YouTube Data API have a default quota allocation of 100 search.list calls, 100 videos.insert calls, and 10,000 units per day combined for all other endpoints."

Most reads cost 1 unit. Search is the wall: 100 calls a day, in its own bucket. Google also bills your mistakes: "All API requests, including invalid requests, incur at least a one-point quota cost." More quota is available, but only after a compliance audit.

The logged-out surface is unusually generous. A channel's RSS feed returns its 15 most recent uploads with view and like counts, oEmbed returns a video's title, author and thumbnail as JSON, and watch pages carry the full player response. The catch is captions: most caption tracks now need a proof-of-origin token before they return a single byte. The full no-key picture, with the feed format and the handle-to-channel-ID fix, and how the caption token works, each have their own page.

Use the official API if search volume stays under 100 a day. Past that, no amount of key management helps.

Bluesky: an API with no key at all

Bluesky's documentation says most app.bsky.* GET requests "are public and can be called without authentication" against the public AppView at public.api.bsky.app, which adds caching on top.

A request to app.bsky.actor.getProfile with no key returns exact follower, following and post counts as JSON. app.bsky.feed.getAuthorFeed returns an account's posts the same way. The responses carry Access-Control-Allow-Origin: *, so you can call them straight from a browser without a server in between. Writes and anything account-private need authentication. Public reads do not.

Use the official API. There is no reason to do anything else.

Twitch: free, but always with a token

Twitch's Helix API refuses every request that does not carry an OAuth token and your app's client ID. A bare request returns 401 with the message "OAuth token is missing."

Getting a token is simple, though. Register an app, then use the client-credentials flow for an app access token, which Twitch says "lets you access their non-sensitive data only (and doesn't require the user's permission)." Requests draw on a points bucket per app, and each endpoint's documentation states its cost.

Use the official API. Twitch is the easiest official path in this list once you have registered.

X / Twitter: pay per post, no free tier

X moved its API to pure pay-per-use. X's pricing page says "No subscriptions—pay only for what you use," and lists the read prices per resource returned:

Read	Price
Posts	$0.005 per resource
Users	$0.010 per resource
Likes, mutes, blocks	$0.001 per resource
Your own data ("owned reads")	$0.001 per resource

"Per resource" is the detail to price against. A timeline call that returns 20 posts is 20 reads. Resources are deduplicated within a UTC day, and pay-per-use plans are capped at 3 million post reads per monthly billing cycle. No free tier is listed.

The logged-out surface is the embed infrastructure publishers depend on. The single-post embed service returns one post as JSON with its like count, and oEmbed returns a post's text for display. Logged-out profile pages now show the bio, follower and following counts and the latest few posts before a login prompt covers the rest (checked 2026-09-25), and the embed timeline rate limits after roughly 30 requests. For more on each route, see how to view tweets without an X account.

Use the official API if you can price your volume at half a cent a post. For a few thousand posts a month it is the cheapest reliable route there is.

Threads: a real read API, gated twice

The Threads API does read other people's public content. profile_lookup and profile_posts read a public account by username, and keyword_search searches public posts. All three are free.

Two gates decide whether that is usable:

• App Review. "With standard access, only some of the official Meta accounts can be looked up. These include @meta, @threads, @instagram, and @facebook." Until Meta approves your app, you can read four accounts. Keyword search quietly narrows to your own posts until "After approval, public posts will be searchable."
• Shape. Profile lookup "Only returns public profiles with at least 100 followers" and allows 1,000 requests per rolling 24 hours. Keyword search allows 2,200 queries a day, and on every result "The owner field is excluded and will not be returned." You can search public posts, but the API will not tell you who wrote them.

Logged out, a Threads post page is rendered in the browser. A plain request receives a large HTML document with no post text in it. What the Threads API will and will not read has the full rundown.

Use the official API if you already know the usernames you need and they clear 100 followers.

Instagram: reads accounts that authorised you, and little else

Instagram's official API reads Business and Creator accounts that have connected to your app, through either Instagram Login or Facebook Login for Business. Personal accounts are not covered. The older Basic Display API is gone. Meta's changelog for 4 December 2024 says: "All requests to the Instagram Basic Display API will return an error message."

The one outward-looking read is business discovery, which returns follower count, media count and per-post like and comment counts for another Business or Creator account. It returns counts, never comment text, and nothing about personal accounts. Hashtag search is capped at 30 unique hashtags per account per rolling 7 days. The API is free, and anything beyond your own test accounts needs App Review.

The logged-out surface has been closing for years. Instagram's internal JSON endpoints, including profile info and search, refuse or rate limit logged-out callers almost immediately. The profile page itself is still served, but what it contains depends heavily on who is asking. What Instagram's official API actually returns goes endpoint by endpoint, including the rate-limit rules that make business discovery smaller than it looks.

Use the official API if your users will connect their own professional accounts. For anyone else's data it has almost nothing.

Facebook: public Pages, behind review

The Graph API can read public Pages you do not manage, but only through the Page Public Content Access feature. Meta describes it as access to "the Pages Search API and to read public data for Pages," for apps that "Analyze and/or display posts and engagement on Pages." It "requires successful completion of the App Review process" and "is only available with business verification." Personal profiles are out of scope.

Two other official routes exist and each fits a narrow reader:

• The Ad Library API covers ads, is free, and needs an identity-verified token. The field-by-field reference covers the token path and which fields are actually populated.
• Meta Content Library covers public posts across Facebook, Instagram and WhatsApp Channels, and costs nothing: "There are no fees associated with access or computation." Applicants "must be affiliated with a qualified academic institution or a qualified non-academic research institution." Commercial use is not an option.

Logged out, a public Page renders in a browser, but a plain HTTP request to the same Page is frequently refused outright.

Use the official API if you can pass business verification and your use case is Pages, not people.

TikTok: three APIs, none for commercial public reads

TikTok publishes three read APIs, and each is built for a different reader:

• Display API reads an account that logged in to your app. The video.list scope reads "a user's public videos," meaning that user's, not anyone's.
• Research API reads public content broadly, but only for researchers. Eligible applicants are academic institutions in the US, EEA, UK, Canada or Switzerland, not-for-profit research bodies in the EU, and Brazilian academic or non-profit researchers studying youth safety. Applicants must "Be independent of commercial interests." Commercial users, creators and advertisers are not eligible.
• Commercial Content API covers ads and advertisers, by application.

So a commercial product has no official way to read an arbitrary public TikTok account. The logged-out surface is thin but real: TikTok documents an oEmbed endpoint that returns a video's title, author and thumbnail, and public video pages carry engagement stats. Those stats arrive already rounded: the page's own data says 1600000 plays rather than the exact figure, so no parser can recover more precision than TikTok ships.

Use the official API if you are an accredited researcher. For everyone else there is no official route to public data.

Reddit: free for approved clients, closed to anonymous callers

Reddit's Data API wiki is short on the point: "Clients must authenticate with a registered OAuth token. We can and will freely throttle or block unidentified Data API users." Use is "subject to our Responsible Builder Policy, Developer Terms and Data API Terms," and access is by request rather than self-service.

For clients that qualify for free access, the limit is "100 queries per minute (QPM) per OAuth client id," averaged over a 10-minute window so short bursts are allowed. Commercial use needs a separate agreement with Reddit, and the wiki publishes no price for it.

The logged-out picture changed more than any other in this table. The .json routes every tutorial still recommends now return 403 with an HTML page to logged-out clients. The .rss feeds for subreddits and users still return posts as Atom, but a feed entry carries no score and no comment count. Individual posts and their comment threads are blocked logged-out.

Use the official API if you can get approved and 100 queries a minute covers you. That is a lot for monitoring a few communities, and nowhere near enough for a backfill.

LinkedIn: open for sign-in, partners for everything else

LinkedIn is candid about it: "Most permissions and partner programs require explicit approval from LinkedIn. Open Permissions are the only permissions that are available to all developers without special approval." The open permissions are sign-in (the authenticated member's name, headline, photo and email) and sharing on that member's behalf.

Everything else sits in a partner programme: Marketing, Sales Navigator, and Talent. Compliance access "is closed and may not be requested." There is no self-service way to read arbitrary profiles or company posts, and no published price, because access is a partnership, not a plan.

Logged out, public company pages render with the company's name, description and exact follower count. Content search asks you to sign in.

Use the official API if you are building sign-in, sharing, or a product that qualifies for a partner programme.

Pinterest: reads your own account

Pinterest's API v5 is open to register, and it starts you on Trial access, which permits reading boards and Pins. Standard access needs an upgrade request with a video demo that shows the OAuth flow and a live integration.

The scoping is the catch. Pinterest's own API description says the Pin and board endpoints return content "owned by the 'operation user_account' - or on a group board that has been shared with this account," and that account defaults to whoever authorised the token. The API reads your users' Pinterest, not Pinterest at large.

Logged out, every user and board has an RSS feed of its recent Pins, and those still answer plain requests.

Use the official API if your users will connect their own Pinterest accounts.

Where a third-party social media API fits

Start with the official API wherever the table says it covers your use case. It is free or cheap, documented, versioned, and it will not break the week a platform ships a frontend change. That means YouTube within quota, Bluesky, Twitch, X if the per-post price works, and any product where users connect their own accounts.

A third-party API earns its place in the gaps that table exposes: public data about accounts that never authorised you, on platforms whose official API will not read them for a commercial product, across several platforms at once. Three things to know before you choose one:

1. It reads the same public surfaces listed in the last column. A vendor cannot get data a platform does not serve to logged-out visitors. Anything more means logging in, and logged-in collection carries risk that logged-out reading does not. That legal line is covered here.
2. It will fail more often on the defended platforms. Instagram, Facebook, TikTok and Reddit refuse unfamiliar clients, so every vendor fails some requests there, and many route through residential proxies to fail fewer. What matters is whether you pay for the failures, and whether a response that comes back empty but successful is treated as a failure.
3. A unified schema is the real product. Every platform describes a follower count its own way. A layer that maps them into one shape, and keeps the original payload next to it, saves more engineering time than any single endpoint.

We sell an API of this kind, so weigh this section as coming from an interested party. Ours returns a unified schema with the platform's raw payload alongside it, and it never charges for a failed request or an empty result. Everything above the heading is the platforms' own documentation, linked below so you can check it.

---

Sources, all read 2026-09-25. YouTube Data API overview and quota · YouTube quota and compliance audits · Bluesky developer documentation, "API Hosts and Auth" · Twitch developer documentation, authentication and Helix · X API pricing · Threads profile lookup · Threads keyword search · Instagram Platform changelog · Instagram business discovery · Instagram hashtag search · Page Public Content Access · Meta Content Library · TikTok Research API eligibility · TikTok Commercial Content API · Reddit Data API wiki · Getting access to LinkedIn APIs · Pinterest access tiers · Pinterest API v5 description

Official API terms in this category change often and usually without an announcement. Every row above carries the date it was checked; re-check the ones you depend on before you size a product against them.