"No API key" sounds like it means "no friction". With Yahoo Finance it means something narrower and stranger: there's no key to apply for because there's no official API at all. What survived the 2017 shutdown is the same set of undocumented endpoints the yahoo.com front-end calls — open to anyone who replays the browser's handshake correctly.
What "no API key" actually buys you
Yahoo deprecated its documented YQL finance API in 2017. There is no successor, no developer portal, no token to request. So every library and "Yahoo Finance API" you find today is pointed at two hostnames the website uses internally: query1.finance.yahoo.com and query2.finance.yahoo.com. They return JSON, they don't ask for a key — and that's exactly why they're fragile. Nobody promised they'd stay the same shape, and Yahoo has changed the auth dance more than once and broken every downstream tool overnight.
So the right mental model isn't "free API". It's "the browser's private endpoints, which you're allowed to hit if you behave like the browser." Three of those endpoints cover almost everything people want.
The three endpoints that matter
1. Real-time quote
GET /v7/finance/quote?symbols=AAPL,MSFT,BTC-USD
The cheapest call. Returns last price, day range, market cap, P/E and 52-week high/low for a comma-separated list of symbols in one shot. Crypto (BTC-USD), FX (EURUSD=X) and indices (^GSPC) all use the same endpoint.
2. Fundamentals & financials
GET /v10/finance/quoteSummary/AAPL?modules=incomeStatementHistory,balanceSheetHistory,defaultKeyStatistics
The richest call, and the one that requires the crumb. You request named modules — income statement, balance sheet, cash flow, key stats, earnings, recommendations — and get back annual and quarterly history. Ask only for the modules you need; each one is a separate parse on Yahoo's side.
3. Historical prices
GET /v8/finance/chart/AAPL?period1=0&period2=9999999999&interval=1d
OHLCV candles. period1/period2 are Unix seconds; interval ranges from 1m (last ~7 days only) through 1d, 1wk, 1mo. Pass events=div,splits to get the dividend and split adjustments most backtests forget to apply.
The crumb-and-cookie handshake
This is the part that trips up nine out of ten first attempts. The quoteSummary and download endpoints reject you unless you carry a crumb — a short anti-CSRF token — and the exact cookie that minted it. The sequence is non-negotiable:
Get a cookie
Hit any Yahoo page (https://fc.yahoo.com works) and keep the Set-Cookie value, especially the A3 consent cookie. Without it the crumb is worthless.
Mint a crumb with that cookie
Call GET https://query2.finance.yahoo.com/v1/test/getcrumb sending the cookie back. You get a short opaque string like aB3xK1q.7Z. It's bound to that cookie — mix and match and you'll see 401 Invalid Crumb.
Send both on every data call
Append &crumb=<crumb> to the URL and replay the cookie in the header. Reuse the same pair for the whole session rather than re-handshaking per request — that's the single biggest thing that keeps you off the rate limiter.
A complete fundamentals pull, handshake and all, looks like this:
# 1. cookie 2. crumb 3. data — all sharing one cookie jar
curl -s -c jar.txt "https://fc.yahoo.com" -A "Mozilla/5.0" -o /dev/null
CRUMB=$(curl -s -b jar.txt -A "Mozilla/5.0" \
"https://query2.finance.yahoo.com/v1/test/getcrumb")
curl -s -b jar.txt -A "Mozilla/5.0" \
"https://query2.finance.yahoo.com/v10/finance/quoteSummary/NVDA?modules=defaultKeyStatistics,financialData&crumb=$CRUMB"python-requests or curl/8.x agent. A browser-like User-Agent on all three calls — cookie, crumb and data — is the difference between JSON and a wall. If your crumb suddenly stops working mid-session, you've usually been rotated to a fresh cookie by a load balancer; re-run step 1.Which numbers live where (so you don't guess)
The same figure can appear under several modules with subtly different definitions. A quick map saves a lot of "why is my P/E different from the website" debugging:
| You want | Endpoint / module | Field |
|---|---|---|
| Last traded price | /v7/finance/quote | regularMarketPrice |
| Market cap | quote | marketCap |
| Trailing P/E | quote | trailingPE |
| Revenue (annual) | incomeStatementHistory | totalRevenue |
| Free cash flow | financialData | freeCashflow |
| Split-adjusted close | /v8/finance/chart | adjclose (with events=splits) |
The adjclose distinction is the one that quietly ruins backtests: raw close ignores splits, so a 4-for-1 stock split shows up as a fake 75% crash. Always pull adjusted closes for anything that spans a corporate action.
Skip the handshake, keep the JSON
Our maintained Yahoo Finance Actor manages the cookie, crumb and User-Agent for you and returns quotes, fundamentals or historical candles as clean JSON or CSV — no 401s to debug. Free Apify credits to start.
Run the Yahoo Finance Actor → Or get done-for-you leadsRate limits, in the absence of documented ones
There's no published quota, which is its own kind of trap: nothing tells you you're close until you get a 429 or a sudden empty body. From a single datacenter IP, a few hundred rapid quoteSummary calls is roughly where it tips. Three habits keep bulk jobs alive: reuse one cookie/crumb pair per session instead of re-handshaking, batch symbols into the quote endpoint (it takes dozens at once), and space historical pulls so you're not hammering /v8/chart in a tight loop. For a watchlist of a few hundred tickers refreshed a few times a day, a single IP is fine. For scanning the whole market, you need rotating IPs — which is the moment a managed actor stops being a convenience and becomes the cheaper option.
When to handshake yourself, and when not to
If you're pulling one ticker for a side project, replay the three calls above and move on — it's twenty lines of code. The handshake becomes a liability when it's load-bearing: a dashboard that breaks the next time Yahoo rotates its crumb logic, or a nightly job that quietly returns empty cells because one IP got throttled. That's the line where outsourcing the cookie, crumb, User-Agent and proxy rotation to a maintained actor pays for itself — you keep calling one stable endpoint and let someone else absorb Yahoo's next surprise.
Disclosure: links to Apify on this page are affiliate links, marked rel="sponsored". If you create a paid account through them we may earn a commission at no extra cost to you. We recommend Apify because we build and ship Actors on it ourselves, including the Yahoo Finance Actor linked above.