Hosted CertStream API - Real-Time Certificate Transparency

Get access

Access comes with a GitHub sponsorship. Pick a tier, then claim your key with the same GitHub account.

Tier	Price	Streams
Stream	$2 a month	Domains-only and lite
Full	$10 a month	Adds the full stream, with the DER certificate and chain
Developer, Pro, Silver, Gold	$15 to $300 a month	Everything in Full, plus the perks listed on the sponsor page

1. Sponsor

Choose a tier on the GitHub Sponsors page.

2. Claim your key

3. Connect

Add ?key=YOUR_KEY to the endpoint URL, or send an Authorization: Bearer header.

Sponsor on GitHub

Connect to the CertStream WebSocket

Certificates arrive as JSON text frames in the same format as the self-hosted server. Clients that support WebSocket compression (Python websockets, Node ws, browsers) receive about 5 times less data with no code change.

Endpoint	Stream	Tier
`wss://api.certstream.dev/?key=KEY`	Domain names only (default), ~200 B per certificate	Stream
`wss://api.certstream.dev/lite?key=KEY`	Lite, without DER and chain, ~1 KB per certificate	Stream
`wss://api.certstream.dev/full-stream?key=KEY`	Full, with DER and chain	Full

Keep the key private. A client that can set headers should send Authorization: Bearer KEY instead, which keeps the key out of URLs and proxy logs.

Each IP address can hold two connections at once. A third is refused with HTTP 429.

Python

import asyncio, json, os, websockets

URL = "wss://api.certstream.dev/?key=" + os.environ["CERTSTREAM_KEY"]

async def main():
    async with websockets.connect(URL) as ws:
        async for message in ws:
            event = json.loads(message)
            if event["message_type"] == "dns_entries":
                print(event["data"])

asyncio.run(main())

JavaScript

const ws = new WebSocket("wss://api.certstream.dev/?key=YOUR_KEY");
ws.onmessage = (e) => {
  const event = JSON.parse(e.data);
  if (event.message_type === "dns_entries") console.log(event.data);
};

websocat

websocat "wss://api.certstream.dev/?key=$CERTSTREAM_KEY"

Use it with existing CertStream clients

Point a client that already speaks CertStream at the lite endpoint. Only the URL changes.

Pythoncertstream library

import certstream

def on_message(message, context):
    if message["message_type"] == "certificate_update":
        print(message["data"]["leaf_cert"]["all_domains"])

certstream.listen_for_events(on_message, url="wss://api.certstream.dev/lite?key=YOUR_KEY")

Message format

domains-only/

{
  "message_type": "dns_entries",
  "data": ["example.com", "*.example.com"]
}

lite/lite, abbreviated

{
  "message_type": "certificate_update",
  "data": {
    "update_type": "PrecertLogEntry",
    "leaf_cert": {
      "issuer": { "CN": "Amazon RSA 2048 S09" },
      "not_before": 1792405638,
      "not_after": 1796297238,
      "all_domains": ["example.com"]
    },
    "seen": 1792409244.748,
    "source": { "name": "DigiCert Sphinx2026h2" }
  }
}

Every field is described in the API documentation.

Why access is paid

This endpoint was free until November 2026. The servers and their bandwidth cost real money every month, and a free stream could not pay for them, so access now comes with a sponsorship. Self-hosting stays free under the MIT license.

Every public sponsor is shown below, companies with their logo.

Frequently asked questions

Is the hosted CertStream API free?

No. Access needs an API key, from $2 a month through GitHub Sponsors. Running your own certstream-server-rust is free under the MIT license.

How do I get an API key?

Sponsor the project on GitHub, then sign in with the same GitHub account at api.certstream.dev/claim and press Generate API key. The key is shown once, so copy it then.

Can I use it with existing CertStream clients?

Yes. The lite stream uses the same message format as the original CertStream, so a client only needs its URL changed to wss://api.certstream.dev/lite?key=YOUR_KEY. The Python certstream library works this way.

What is the difference between domains-only and lite?

Domains-only sends just the domain names of each certificate, about 200 bytes per message. Lite adds the issuer, validity dates, fingerprints and log source, about 1 KB per message.

Which Certificate Transparency logs does it read?

The Chrome- and Apple-trusted CT logs, both RFC 6962 and static-ct-api, with certificates that appear in more than one log delivered once.

Can I get the full stream with the DER certificate and chain?

Yes, from the $10 Full tier upwards, at wss://api.certstream.dev/full-stream. You can also run your own instance of certstream-server-rust, which serves it.

What happens when I stop sponsoring?

The key stops working when the paid period ends, and a new key can be generated whenever you sponsor again.

Want to run it yourself? See the quick start or the certstream-server-rust repository.