Forum Settings
Forums

[Nov 2021] Public information can now be accessed without authentication

New
Nov 18, 2021 4:45 AM
#1
四十二

Offline
Mar 2016
465
Great news! Starting from November 2021, all API endpoints querying publicly available information can be accessed without the need of authenticating the user using the OAuth2 protocol.

To do this, you still need to create an application in the API panel of your profile. Once you receive a Client ID, you can simply add an HTTP header called X-MAL-CLIENT-ID and set it to its value. This header must be included in every request to the API.

Here's an example:

Request
GET https://api.myanimelist.net/v2/anime/10357?fields=rank,mean,alternative_titles
> X-MAL-CLIENT-ID: a1b2c3d4e5f6
"a1b2c3d4e5f6" must be replaced with your Client ID


Response
{
    "id": 10357,
    "title": "Jinrui wa Suitai Shimashita",
    "main_picture": {
        "medium": "https://api-cdn.myanimelist.net/images/anime/4/45704.jpg",
        "large": "https://api-cdn.myanimelist.net/images/anime/4/45704l.jpg"
    },
    "rank": 935,
    "mean": 7.76,
    "alternative_titles": {
        "synonyms": [
            "Jintai"
        ],
        "en": "Humanity Has Declined",
        "ja": "人類は衰退しました"
    }
}


Naturally, the OAuth2 authentication scheme is still valid and it's required to access private information or to take actions on behalf of a user.

More information can be found in the documentation.
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Reply Disabled for Non-Club Members
Pages (2) [1] 2 »
Nov 18, 2021 6:51 AM
#2

Offline
Feb 2012
285
Thanks for the info. This has great potential for a project I'm planning down the road. Having users login all the time wasn't optimal.
Nov 18, 2021 9:19 AM
#3

Offline
Dec 2018
72
Thank you so much! I've been waiting for this!
Nov 18, 2021 12:49 PM
#4

Offline
Jun 2014
9
This is great!
Nov 18, 2021 1:35 PM
#5

Offline
Dec 2018
72
@ZeroCrystal upon looking further into this, I noticed that /users/{user_name}/animelist still requires main_auth for public lists. Will this be changed?
Nov 18, 2021 2:09 PM
#6
Offline
May 2014
20
Great news!
Nov 18, 2021 3:49 PM
#7

Offline
Aug 2017
7007
That's very cool. Are the ratelimits still in place via this approach?


My biggest regret: Reading all 200+ chapters of Kanojo, Okarishimasu
Nov 18, 2021 5:59 PM
#8
Offline
Jul 2018
564089
I do not understand.
Nov 19, 2021 5:37 AM
#9
四十二

Offline
Mar 2016
465
Squashbucklr said:
@ZeroCrystal upon looking further into this, I noticed that /users/{user_name}/animelist still requires main_auth for public lists. Will this be changed?

I'll check this out, thanks for the report.


asuramaru1 said:
I do not understand.

May I know what is unclear? I can try to explain it better.

If you've already been using the API, you should know that completing the OAuth procedure was the only way to access all endpoints. This was an inconvenience for many developers, thus several public endpoints have been made accessible with a much simpler authentication scheme.
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Nov 19, 2021 7:03 AM

Offline
Dec 2018
72
ZeroCrystal said:

I'll check this out, thanks for the report.

Thank you. Could you let me know if this gets changed?
Nov 19, 2021 7:16 AM
四十二

Offline
Mar 2016
465
Squashbucklr said:
ZeroCrystal said:

I'll check this out, thanks for the report.

Thank you. Could you let me know if this gets changed?


Sure! I might need a few days to get an answer. I'll ping you when I have something new to share.
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Nov 19, 2021 3:02 PM
Offline
Aug 2009
10
OMG Finally! I've been moving to AniLists API because it's public but now I can switch back :D, woot!
Nov 24, 2021 2:03 AM
Offline
Jul 2014
2
ZeroCrystal said:
Squashbucklr said:

Thank you. Could you let me know if this gets changed?


Sure! I might need a few days to get an answer. I'll ping you when I have something new to share.


It's working now!



EDIT: it works for other profiles too. Not just my own profile.

Nov 24, 2021 2:06 AM
四十二

Offline
Mar 2016
465
T912938 said:
ZeroCrystal said:


Sure! I might need a few days to get an answer. I'll ping you when I have something new to share.


It's working now!


Yep. It should have been fixed yesterday, but I didn't have the time to test it yet.

Pinging @Squashbucklr too.
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Nov 24, 2021 9:09 AM

Offline
Dec 2018
72
ZeroCrystal said:
T912938 said:


It's working now!


Yep. It should have been fixed yesterday, but I didn't have the time to test it yet.

Pinging @Squashbucklr too.


Thanks so much for letting me know and for seeing this change through! I'd been hoping for this specific change since the launch of the API and now it's finally here!
Nov 25, 2021 4:34 AM
Offline
Oct 2021
3
Awesome!
Nov 26, 2021 12:43 PM
Offline
Jul 2010
10
Aw man this is amazing news!!
Thanks for the update <3
Dec 5, 2021 11:47 AM
Offline
Oct 2021
3
What is considered publicly available information?
Dec 6, 2021 5:29 AM
四十二

Offline
Mar 2016
465
Jan 27, 2022 12:01 AM
Offline
Aug 2014
1
Hi,

How to get response with python? I am trying wit this code. Can anyone help?

import requests
import json
from requests_oauthlib import OAuth1

url = "https://api.myanimelist.net/v2/anime/10357?fields=rank,mean,alternative_titles"

auth = OAuth1('7779251b68f8f6b99e84ffb838080476')

payload = {}
headers= {}

response = requests.get(url, headers=headers, data=payload, auth=auth)

result = json.loads(response.text)


print(response)
Jan 27, 2022 9:52 PM

Offline
Nov 2013
126
hi, anyone can help me why i just got detail on "genres" only?
there is "theme" and "demographic" but i dont get them

for example
Genres: Action, Adventure, Comedy, Drama, Fantasy
Theme: Military
Demographic: Shounen

I only got "Action, Adventure, Comedy, Drama, Fantasy", there is no "military" and "shounen"
Jan 28, 2022 5:58 AM
四十二

Offline
Mar 2016
465
aoylmz said:
How to get response with python? I am trying wit this code. Can anyone help?

Hi! The easiest/shortest Python script I can think of is this:

import requests

CLIENT_ID = 'YOUR CLIENT ID'

url = 'https://api.myanimelist.net/v2/anime/10357?fields=rank,mean,alternative_titles'

response = requests.get(url, headers = {
    'X-MAL-CLIENT-ID': CLIENT_ID
    })

response.raise_for_status()
anime = response.json()
response.close()

print(anime)

# Output:
#
# {'id': 10357, 'title': 'Jinrui wa Suitai Shimashita',
#  'main_picture': {'medium': 'https://api-cdn.myanimelist.net/images/anime/4/45704.jpg',
#  'large': 'https://api-cdn.myanimelist.net/images/anime/4/45704l.jpg'}, 'rank': 939,
#  'mean': 7.76, 'alternative_titles': {'synonyms': ['Jintai'],
#  'en': 'Humanity Has Declined', 'ja': '人類は衰退しました'}}
ZeroCrystalJan 28, 2022 6:08 AM
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Jan 28, 2022 6:33 AM
四十二

Offline
Mar 2016
465
ZaviieR said:
hi, anyone can help me why i just got detail on "genres" only?
there is "theme" and "demographic" but i dont get them

for example
Genres: Action, Adventure, Comedy, Drama, Fantasy
Theme: Military
Demographic: Shounen

I only got "Action, Adventure, Comedy, Drama, Fantasy", there is no "military" and "shounen"

Which anime are you referring to?

I tested Fullmetal Alchemist: Brotherhood but it returns all genres/themes + demographic.
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Jan 29, 2022 11:00 AM
Offline
Feb 2021
1
Thanks, great news.
Apr 3, 2022 7:15 PM
Offline
Nov 2019
2
Hello,

How can I get response with js? I am kinda noob on js and im trying this code. Can anyone help?

const CLIENT_ID = "my client id";
const mal =
"https://api.myanimelist.net/v2/users/Febonebo/animelist?fields=list_status&limit=1";

fetch(mal, {
headers: {
"X-MAL-CLIENT-ID": CLIENT_ID,
},
})
.then((res) => res.json())
.then((data) => console.log(data));

My profile is public, but im still getting blocked. When i try to include "no-cors" i get 403 error. I only need the anime list, that´s it.
Apr 4, 2022 7:13 AM
四十二

Offline
Mar 2016
465
Febonebo said:
My profile is public, but im still getting blocked. When i try to include "no-cors" i get 403 error. I only need the anime list, that´s it.

That's not strictly related to the API but to the limitations of running JavaScript on a web browser. CORS policies won't let you download data from other websites if it's not explicitly allowed by them using the appropriate HTTP headers. You can read more about this here.

Unfortunately, MAL's API currently lacks this kind of support, and it probably won't be added anytime soon.

Running your code natively on your device (rather than from a webpage) is certainly the easiest way to solve this.

But, if you're working on something that must run on a browser, it's harder to find a solution. For example, you can create a userscript with Tampermonkey, or you can set up a simplified reverse proxy using traditional technologies or a serverless platform. Either way, it's certainly an inconvenience.
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Apr 4, 2022 8:22 AM
Offline
Nov 2019
2
ZeroCrystal said:
Febonebo said:
My profile is public, but im still getting blocked. When i try to include "no-cors" i get 403 error. I only need the anime list, that´s it.

That's not strictly related to the API but to the limitations of running JavaScript on a web browser. CORS policies won't let you download data from other websites if it's not explicitly allowed by them using the appropriate HTTP headers. You can read more about this here.

Unfortunately, MAL's API currently lacks this kind of support, and it probably won't be added anytime soon.

Running your code natively on your device (rather than from a webpage) is certainly the easiest way to solve this.

But, if you're working on something that must run on a browser, it's harder to find a solution. For example, you can create a userscript with Tampermonkey, or you can set up a simplified reverse proxy using traditional technologies or a serverless platform. Either way, it's certainly an inconvenience.


I see, tyvm for the answer.
Apr 18, 2022 7:18 AM
四十二

Offline
Mar 2016
465
N0D4N said:
also i've tried
https://api.myanimelist.net/v2/users/N0D4N/mangalist?fields=list_status{tags}&limit=1
but this just doesn't return list_status at all.

Strange, I tested the same URL but it correctly returns the tags together with the other fields.

GET https://api.myanimelist.net/v2/users/N0D4N/mangalist?fields=list_status{tags}&limit=1

{
    "data": [
        {
            "node": {
                "id": 126146,
                "title": "\"Oshi no Ko\"",
                "main_picture": {
                    "medium": "https:\/\/api-cdn.myanimelist.net\/images\/manga\/3\/233991.jpg",
                    "large": "https:\/\/api-cdn.myanimelist.net\/images\/manga\/3\/233991l.jpg"
                }
            },
            "list_status": {
                "status": "dropped",
                "is_rereading": false,
                "num_volumes_read": 3,
                "num_chapters_read": 30,
                "score": 0,
                "updated_at": "2022-04-18T08:01:09+00:00",
                "tags": [
                    "text tet"
                ]
            }
        }
    ],
    "paging": {
        "next": "https:\/\/api.myanimelist.net\/v2\/users\/N0D4N\/mangalist?offset=1&fields=list_status%7Btags%7D&limit=1"
    }
}


How are you sending the request? Can you post the code you're running?
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Apr 18, 2022 10:24 AM
四十二

Offline
Mar 2016
465
@N0D4N, that's because curl skips special characters instead of URL-encoding them, so the curly brackets were removed from the final URL.

You can obtain the correct result with:
curl --get \
     --data-urlencode fields=list_status{tags} \
     --data-urlencode limit=1 \
     -H "X-MAL-CLIENT-ID: a1b2c3d4" \
     "https://api.myanimelist.net/v2/users/N0D4N/mangalist"
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Jun 30, 2022 10:49 AM
Offline
Nov 2021
5
I guess @ me for the request Get User Anime, requires Main authorization.
Jun 30, 2022 11:03 AM
四十二

Offline
Mar 2016
465
RahulARanger said:
I guess @ me for the request Get User Anime, requires Main authorization.

Correct. That's because you're not providing any information that can identify the user.

You might need to ask them their username if you're planning to use this authentication method.
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Jun 30, 2022 11:42 AM
Offline
Nov 2021
5
ZeroCrystal said:
RahulARanger said:
I guess @ me for the request Get User Anime, requires Main authorization.

Correct. That's because you're not providing any information that can identify the user.

You might need to ask them their username if you're planning to use this authentication method.


Thanks, Got it
Jul 31, 2022 2:48 PM

Online
Dec 2019
3439
I wish someone had mentioned me here earlier!

@ZeroCrystal

Usually this API always work for me to bypass cors issues, but in this case aren't even working.

Is there a way to make it work at all directly on the browser console or on tampermonkey, or we all have to wait until MAL whitelist themselves? haha

fetch(`https://api.allorigins.win/get?url=${encodeURIComponent('https://api.myanimelist.net/v2/users/Febonebo/animelist?fields=list_status&limit=1')}`, {
  "headers": {
    "x-mal-client-id": "x"
  },
  "method": "GET"
});
Aug 1, 2022 2:56 PM
四十二

Offline
Mar 2016
465
hacker09 said:
Is there a way to make it work at all directly on the browser console or on tampermonkey, or we all have to wait until MAL whitelist themselves? haha

Tampermonkey provides the GM_xmlhttpRequest() function to send an HTTP request bypassing all CORS restrictions. In this way, you can avoid using proxies or other means to access the API.
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Aug 1, 2022 3:11 PM

Online
Dec 2019
3439
@ZeroCrystal

Oh that's true I forgot about it.

So, right below our Client ID it says that "Client ID and Client Secret must not be disclosed.", but how should I deal with that statement when I can't minify/encode or do whatever else with the client secret?
That is against greasyfork and likely openuserjs website rules and those are basically the only 2 scripts website providers online.

Should I just ignore that statement then?
Aug 1, 2022 4:37 PM
四十二

Offline
Mar 2016
465
hacker09 said:
So, right below our Client ID it says that "Client ID and Client Secret must not be disclosed.", but how should I deal with that statement when I can't minify/encode or do whatever else with the client secret?
That is against greasyfork and likely openuserjs website rules and those are basically the only 2 scripts website providers online.

Should I just ignore that statement then?

That statement is partially wrong. Indeed, the Client Secret must always be kept in a safe location. But the same doesn't apply to the Client ID (otherwise, you would have no way to authenticate your users).

Userscripts and other applications that cannot maintain the confidentiality of their client credentials are called public clients.
Public clients should not use a Client Secret to perform the authorisation procedure.

When you create a new application, MAL lets you choose between a confidential client ("web") and a public client ("Android", "iOS", and "Other").
Hence, you should choose the "other" app type.
You will still be able to access the API but without having to use a Client Secret.

A final note: code obfuscation techniques must not be used to hide a sensitive piece of information, especially in JavaScript.
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Aug 1, 2022 4:40 PM

Online
Dec 2019
3439
Aug 16, 2022 3:01 AM
Offline
May 2019
1
@ZeroCrystal

I'm writing a manga app, and wanted to use myanimelist as the public database.
Can I distribute my client-id with my app, or would this create all kinds of security issues?

Is a client-id traceable to an account?

Thnx in advance
Aug 16, 2022 3:22 AM
四十二

Offline
Mar 2016
465
NekoLuka said:
I'm writing a manga app, and wanted to use myanimelist as the public database.
Can I distribute my client-id with my app, or would this create all kinds of security issues?

Is a client-id traceable to an account?

Assuming that you didn't choose "web" as your App Type, you can distribute your Client ID as part of your application (public client).

A Client ID is linked to your account, but only MAL's staff can trace it back to you. A regular user can't identify you.
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Oct 31, 2022 2:05 PM
Offline
Mar 2015
8
T912938 said:
ZeroCrystal said:


Sure! I might need a few days to get an answer. I'll ping you when I have something new to share.


It's working now!



EDIT: it works for other profiles too. Not just my own profile.



Can I ask which Webpage/Software did you use to perform these API calls?
Oct 31, 2022 4:17 PM
Offline
Jul 2014
2
LesCru said:


Can I ask which Webpage/Software did you use to perform these API calls?


Postman desktop app
https://www.postman.com/
Nov 14, 2022 8:07 PM

Offline
Mar 2017
2852
Is there a list of valid values for fields? I'm particularly looking for ones associated with the get anime details endpoint, i.e. https://api.myanimelist.net/v2/anime/<anime_id>.
In other words, using the example at the start of this thread, https://api.myanimelist.net/v2/anime/10357?fields=rank,mean,alternative_titles, what other values besides rank, mean, alternative titles may be specified?
I've already looked through the document at https://myanimelist.net/apiconfig/references/api/v2 and didn't find this information covered.
A møøse once bit my sister...
Nov 15, 2022 6:34 AM
四十二

Offline
Mar 2016
465
mwalimu said:
Is there a list of valid values for fields? I'm particularly looking for ones associated with the get anime details endpoint, i.e. https://api.myanimelist.net/v2/anime/<anime_id>.
In other words, using the example at the start of this thread, https://api.myanimelist.net/v2/anime/10357?fields=rank,mean,alternative_titles, what other values besides rank, mean, alternative titles may be specified?
I've already looked through the document at https://myanimelist.net/apiconfig/references/api/v2 and didn't find this information covered.

If you press 200 OK you can see the list of all available fields.

HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Nov 15, 2022 3:33 PM

Offline
Mar 2017
2852
ZeroCrystal said:

If you press 200 OK you can see the list of all available fields.

Ah, I see that now. It wasn't obvious that the '200 OK' had a dropdown with more information in it.
A møøse once bit my sister...
Dec 10, 2022 3:17 PM
Offline
Mar 2021
3
Creating an iOS for fun and I have been using the example (https://api.myanimelist.net/v2/anime?q=one&limit=4) from the documentation to get started and when I loop through to present to four titles to the UI, it shows that the value of title and such is nil so I am presented with nothing. I figure that X-MAL-CLIENT-ID is working since there are 4 entries but no data is coming back... Any ideas on what the problem is?
Dec 11, 2022 9:07 AM
四十二

Offline
Mar 2016
465
IrresponsibleCap said:
Creating an iOS for fun and I have been using the example (https://api.myanimelist.net/v2/anime?q=one&limit=4) from the documentation to get started [...]

I'm having no issues running your example.

GET https://api.myanimelist.net/v2/anime?q=one&limit=4

{
    "data": [
        {
            "node": {
                "id": 21,
                "title": "One Piece",
                "main_picture": {
                    "medium": "https://api-cdn.myanimelist.net/images/anime/6/73245.jpg",
                    "large": "https://api-cdn.myanimelist.net/images/anime/6/73245l.jpg"
                }
            }
        },
        [...]
    ],
    "paging": {
        "next": "https://api.myanimelist.net/v2/anime?offset=4&q=one&limit=4"
    }
}

Can you show us your code?
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Dec 11, 2022 9:37 PM
Offline
Mar 2021
3
ZeroCrystal said:

Can you show us your code?


It is definitely not something wrong with the API, I am not doing some properly. I am just lost as to what is wrong. Thanks...

struct AnimeList: Codable {
    var data: [Anime]
}

struct Anime: Codable {
    var id: Int?
    var title: String?
}

// Search controller 
class SearchObjController: ObservableObject {
    static let shared = SearchObjController()
    private init() {}
    
    // Client_ID
    var token = "my client ID is here"
    
    @Published var results: [Anime] = []
    @Published var query: String = "one"
    
    func search() {
        // URL for search query
        let listUrl = URL(string: "https://api.myanimelist.net/v2/anime?q=\(query)&limit=4")
        
        // URL request and adding request values
        var request = URLRequest(url: listUrl!)
        request.httpMethod = "GET"
        request.setValue("\(token)", forHTTPHeaderField: "X-MAL-CLIENT-ID")
        
        // Task to get list of anime based on search query
        let getListTask = URLSession.shared.dataTask(with: request) { (data, response, error) in
            
            DispatchQueue.main.async {
                guard let data = data else { return }
                
                do {
                    let res = try JSONDecoder().decode(AnimeList.self, from: data)
                    self.results.append(contentsOf: res.data)
                } catch {
                    print(error)
                }
            }
        }
        getListTask.resume()
    }
}





Dec 12, 2022 8:55 AM
四十二

Offline
Mar 2016
465
I'm far from an expert in Swift, but I think this is your problem:

IrresponsibleCap said:
struct AnimeList: Codable {
    var data: [Anime]
}

struct Anime: Codable {
    var id: Int?
    var title: String?
}

"data" is not an array of Anime entries, but an array of objects containing a single field named "node". The value of each "node" corresponds to your Anime structure.
HTCPCP/1.0  ★ MetaMAL  ★ Picture credits: 第三世界のじょんぺり & 1041uuu
Dec 12, 2022 2:49 PM
Offline
Mar 2021
3
ZeroCrystal said:

"data" is not an array of Anime entries, but an array of objects containing a single field named "node". The value of each "node" corresponds to your Anime structure.


struct AnimeList: Codable {
    var data: [Node]?
}

struct Node: Codable {
    var node: Anime?
    
    struct Anime: Codable {
        var id: Int?
        var title: String?
        var main_picture: MainPicture?
        var rank: Int?
        var mean: Double?
        var alternative_titles: AlternateTitles?
    }
}


I changed it to this and it works now, thank you so much, I did not even notice this.
Feb 23, 2023 6:35 AM

Offline
Jun 2009
58
I'm creating sonarr-like (sickchill, medusa-like) application that uses indexers to obtain metadata. I have reviewed the API agreement 3.(c) 

Can I hardcode X-MAL-CLIENT-ID I got from API panel? All I need is Search and Get Anime Details by ID which is public info.
Just like streamlink does with twitch, client_id is hardcoded here
class TwitchAPI:
    CLIENT_ID = "kimne78kx3ncx6brgo4mv6wki5h1ko"

There's really no point in authorizing each user individually since there' no need to modify data on user behalf

Am I allowed to hardcode client-id? So there's no action needed by users for application to work properly.
wMw_Feb 23, 2023 6:44 AM
Reply Disabled for Non-Club Members
Pages (2) [1] 2 »

More topics from this board

» is there a endpoint that returns reviews of an anime?

zavtot - Nov 17

0 by zavtot »»
Nov 17, 5:43 AM

» I made a webapp to compare plan-to-watch lists

daux - Apr 16, 2022

28 by daux »»
Nov 14, 12:47 PM

» Is there an endpoint in the api that returns anime episode watch history?

itszux - Oct 16

7 by ZeroCrystal »»
Oct 18, 9:15 AM

» Selecting manga by serialization type

isotonico - Sep 17

2 by isotonico »»
Sep 18, 7:24 PM

» User Tags, Related Anime and Related Manga Never Included

Subtonics - Nov 9, 2023

6 by ZeroCrystal »»
Sep 16, 11:15 AM
It’s time to ditch the text file.
Keep track of your anime easily by creating your own list.
Sign Up Login