How to get an Ahrefs API key (the free Domain Rating endpoint now needs one)

In June, Ahrefs made their Domain Rating endpoint free — no API key, no API units, no subscription. A lot of small tools got built on it within days.

That changes on 10 August 2026. From that date the endpoint requires authentication, and unauthenticated requests get a 401. If you built something on it keyless, it stops working that morning.

The fix takes about two minutes, and the key is free.

What the endpoint returns

domain-rating-free gives you one number: Domain Rating, on a 0–100 logarithmic scale, for any domain you ask about. It's Ahrefs' measure of backlink profile strength, and it's the fastest way to size up how authoritative a site is.

Requests are free and consume no API units — that hasn't changed. The only new requirement is that Ahrefs knows who's asking.

Get the API key

You need an Ahrefs account, but not a paid subscription — the public endpoints work with a free key on the Free plan.

1. Sign in and open app.ahrefs.com
2. Click your workspace name (top right) → Account settings
3. In the left sidebar, under Workspace, choose API keys
4. Click Generate API key for public endpoints, name it, and copy the token

That button name matters. It's the one that issues a key scoped to API v3 for public endpoints — the free tier that domain-rating-free needs. Don't go looking for a generic "new key" option.

Check the expiry. Keys are issued with a one-year lifetime, shown in the Expires column on that page. Set a reminder now, or your DR widget will break in twelve months for the same reason it's breaking this week.

Treat the token like a password: keep it server-side, out of client bundles and out of git history. If it leaks, revoke it from the same page and generate a new one.

Test it with curl

Authentication is a bearer header. This confirms the key works:

The response nests the value one level deep, which trips people up:

So it's domain_rating.domain_rating, not domain_rating. The target parameter accepts a bare host or a full URL.

If you get a 401 after 10 August, the key is missing or wrong — that's the whole failure mode.

The attribution rule most DR tools are missing

This is the part worth reading even if your key is already sorted.

The free endpoint isn't a free-for-all — it comes with the Domain Rating License, and that licence grants the right to "use, display, publish or integrate DR Data" subject to attribution. Specifically:

• the exact string "Domain Rating by Ahrefs"
• carrying a functional hyperlink to https://ahrefs.com/
• adjacent to the number, and never "hidden, obscured or removed"

Two details that are easy to miss. First, it applies to any display of the data — per display, not once per site. A badge, a card and a social image each need their own. There's no carve-out for small surfaces. Second, the licence grant itself is conditioned on it: showing DR without attribution isn't untidy, it puts the display outside the licence.

There's a practical trap here too. If your DR component is already wrapped in a link, you can't just nest an <a> inside it for the attribution — browsers split nested anchors when parsing server-rendered HTML, which will quietly wreck your layout. Either make the outer link point at ahrefs.com, or render the attribution link only when the card isn't already a link.

The other thing the licence rules out: re-packaging DR data as a product that "substitutes or competes" with Ahrefs. A DR figure on your own dashboard is well inside that line. A general-purpose "check any domain's DR" tool is a lot closer to it.

Putting DR on a page

If you just want your own Domain Rating visible somewhere without running the plumbing, infra.page has a Domain Rating widget — enter a domain and it tracks DR on a public page, correctly attributed, with history so you can see it move. It's one of ~40 widgets you can put on a single page alongside your GitHub stars, MRR and uptime.

Setting up other integrations? Same series: beehiiv API key, read-only Stripe key, and Sentry auth token.