Khairul Fauzy Khairudin

Posted on Nov 10 AI-assisted

6 tiny APIs I shipped on Cloudflare Workers for $0/month (and what I learned)

#api #cloudflare #javascript #sideprojects

I wanted to see how far the Cloudflare Workers free tier (100k requests/day) can go for small, useful APIs. Over a weekend I built six of them and listed them on RapidAPI. Total hosting bill: $0.

Here's what each one does and one lesson from building it.

1. Email Validator

Syntax, live MX lookup, 10,000+ disposable domains, role accounts (info@, sales@) and typo suggestions (gmial.com → gmail.com).

Lesson: you don't need a DNS library in Workers. Cloudflare's DNS-over-HTTPS endpoint returns JSON:

const r = await fetch(
  `https://cloudflare-dns.com/dns-query?name=${domain}&type=MX`,
  { headers: { accept: "application/dns-json" } }
);
const { Answer = [] } = await r.json();

Port 25 is blocked on Workers, so there is no SMTP mailbox probe. I say that in the docs instead of pretending.

2. Phone Number Validator

245 countries, mobile vs landline vs VoIP, E.164 formatting. It's built on libphonenumber-js/max, and that runs in Workers with no changes.

Lesson: the "max" metadata (needed for line type) is only ~145 KB. Bundle size is not a problem.

3. URL Preview / Open Graph

Paste a link, get title, description, image and favicon, like a Slack unfurl.

Lesson: HTMLRewriter streams the page, so you can stop reading early. YouTube and TikTok rate-limit generic fetchers, so I switched to their official oEmbed endpoints. They're faster and more reliable anyway.

4. QR Code Generator

PNG or SVG, colors, transparent background, plus helpers for Wi-Fi, vCard and WhatsApp QR codes.

Lesson: I wanted no native deps, so I wrote a ~40-line PNG encoder. Workers' CompressionStream("deflate") gives you zlib for free:

async function zlib(data) {
  const cs = new CompressionStream("deflate");
  const w = cs.writable.getWriter(); w.write(data); w.close();
  return new Uint8Array(await new Response(cs.readable).arrayBuffer());
}

I verified every output by decoding it with jsQR.

5. Domain Info

WHOIS via RDAP (the JSON successor to WHOIS), DNS records, SPF/DMARC score, mail provider detection and availability checks.

Lesson: IANA publishes an RDAP bootstrap file (data.iana.org/rdap/dns.json) that maps every TLD to its registry. Watch out for co.uk / com.au: my first version happily reported that co.uk was "registered" when you asked about bbc.co.uk.

6. Public Holidays & Business Days

207 countries plus states, is-holiday, business-days, add-business-days, custom weekends (Fri–Sat).

Lesson: substitute days are where the bugs live. When Christmas falls on a Friday, UK Boxing Day moves to Monday. Test those cases first.

The pattern

Every API is one Worker with the same skeleton:

check the X-RapidAPI-Proxy-Secret header (so nobody bypasses billing)
validate input and return friendly 400 errors
keep /health public for uptime checks

export default {
  async fetch(req, env) {
    const url = new URL(req.url);
    if (url.pathname !== "/health" &&
        req.headers.get("x-rapidapi-proxy-secret") !== env.RAPIDAPI_PROXY_SECRET) {
      return Response.json({ error: "forbidden" }, { status: 403 });
    }
    // ...route
  }
};

Try them

All six have a free tier (100 requests/month):

Honest status: they went live a few days ago and have zero customers so far. What small API do you wish existed? I'm picking the next one based on the replies.

DEV Community