GitHub

Hosted CertStream API

A hosted, CertStream-compatible WebSocket API. Get every new TLS certificate and domain name from Certificate Transparency logs in real time. Access needs an API key, from $2 a month through GitHub Sponsors.

Get access

Access comes with a GitHub sponsorship. Pick a tier, then claim your key with the same GitHub account.

TierPriceStreamsAddresses in 24 hours
Stream$2 a monthDomains-only and lite3
Full$15 a monthAdds the full stream, with the DER certificate and chain5

1. Sponsor

Choose a tier on the GitHub Sponsors page.

2. Claim your key

Sign in with GitHub at api.certstream.dev/claim and generate a key. It is shown once.

3. Connect

Add ?key=YOUR_KEY to the endpoint URL, or send an Authorization: Bearer header.

Sponsor on GitHub

Connect to the CertStream WebSocket

Certificates arrive as JSON text frames in the same format as the self-hosted server. Clients that support WebSocket compression (Python websockets, Node ws, browsers) receive about 5 times less data with no code change.

EndpointStreamTier
wss://api.certstream.dev/?key=KEYDomain names only (default), ~200 B per certificateStream
wss://api.certstream.dev/lite?key=KEYLite, without DER and chain, ~1 KB per certificateStream
wss://api.certstream.dev/full-stream?key=KEYFull, with DER and chainFull

Keep the key private. A client that can set headers should send Authorization: Bearer KEY instead, which keeps the key out of URLs and proxy logs.

Each IP address can hold two connections at once. A third is refused with HTTP 429.

Access is for one customer. All keys of an account together can be used from 3 addresses in 24 hours on Stream and 5 on Full. Sharing or reselling access is not allowed and gets the keys revoked.

Python
import asyncio, json, os, websockets

URL = "wss://api.certstream.dev/?key=" + os.environ["CERTSTREAM_KEY"]

async def main():
    async with websockets.connect(URL) as ws:
        async for message in ws:
            event = json.loads(message)
            if event["message_type"] == "dns_entries":
                print(event["data"])

asyncio.run(main())
JavaScript
const ws = new WebSocket("wss://api.certstream.dev/?key=YOUR_KEY");
ws.onmessage = (e) => {
  const event = JSON.parse(e.data);
  if (event.message_type === "dns_entries") console.log(event.data);
};
websocat
websocat "wss://api.certstream.dev/?key=$CERTSTREAM_KEY"

Use it with existing CertStream clients

Point a client that already speaks CertStream at the lite endpoint. Only the URL changes.

Pythoncertstream library
import certstream

def on_message(message, context):
    if message["message_type"] == "certificate_update":
        print(message["data"]["leaf_cert"]["all_domains"])

certstream.listen_for_events(on_message, url="wss://api.certstream.dev/lite?key=YOUR_KEY")

Message format

domains-only/
{
  "message_type": "dns_entries",
  "data": ["example.com", "*.example.com"]
}
lite/lite, abbreviated
{
  "message_type": "certificate_update",
  "data": {
    "update_type": "PrecertLogEntry",
    "leaf_cert": {
      "issuer": { "CN": "Amazon RSA 2048 S09" },
      "not_before": 1792405638,
      "not_after": 1796297238,
      "all_domains": ["example.com"]
    },
    "seen": 1792409244.748,
    "source": { "name": "DigiCert Sphinx2026h2" }
  }
}

Every field is described in the API documentation.

Why access is paid

This endpoint was free until November 2026. The servers and their bandwidth cost real money every month, and a free stream could not pay for them, so access now comes with a sponsorship. Self-hosting stays free under the MIT license.

Every public sponsor is shown below, companies with their logo.

Frequently asked questions

Not answered here? Write to [email protected].

Before you sponsor

Is the hosted CertStream API free?

No. Access needs an API key through GitHub Sponsors: $2 a month for Stream, $15 a month for Full. Running your own certstream-server-rust is free under the MIT license.

Which tier do I need?

Stream covers the domains-only and lite streams: domain names, issuer, validity dates and fingerprints. Full adds the full stream with the DER certificate and chain, for when you need to parse or store the certificates themselves.

Can I pay yearly?

There is no separate yearly tier. A sponsorship follows your GitHub account's billing cycle, so if your account is billed yearly, the monthly price is charged for twelve months at once.

Can my company sponsor, and do I get an invoice?

Yes. Sponsor from your organisation's GitHub account, then an admin of the organisation signs in at api.certstream.dev/claim and chooses Link an organisation. GitHub sends a receipt for every payment; certstream.dev does not issue separate invoices.

Getting a key

How do I get an API key?

Sponsor the project on GitHub, then sign in with the same GitHub account at api.certstream.dev/claim and press Generate API key. The key is shown once, so copy it then.

I lost my key or it leaked. What now?

Sign in at api.certstream.dev/account, revoke the old key and generate a new one. Keys are stored only as a hash, so a lost key cannot be shown again.

Using the stream

Can I use it with existing CertStream clients?

Yes. The lite stream uses the same message format as the original CertStream, so a client only needs its URL changed to wss://api.certstream.dev/lite?key=YOUR_KEY. The Python certstream library works this way.

What is the difference between domains-only and lite?

Domains-only sends just the domain names of each certificate, about 200 bytes per message. Lite adds the issuer, validity dates, fingerprints and log source, about 1 KB per message.

Can I filter the stream on the server?

Yes. Add domain or issuer to the URL, for example wss://api.certstream.dev/lite?key=YOUR_KEY&domain=example.com, and only matching certificates are sent. Domain terms match subdomains too. The filter syntax is in the API documentation.

How many connections can I open?

Two at a time from each IP address. All keys of one account together can be used from 3 addresses in 24 hours on Stream and 5 on Full.

Do I get the certificates I missed while disconnected?

No. The stream is live, and certificates published while your client is disconnected are not sent later. Reconnect as soon as a connection drops. If you need every certificate without gaps, run your own certstream-server-rust.

Which Certificate Transparency logs does it read?

The Chrome- and Apple-trusted CT logs, both RFC 6962 and static-ct-api, with certificates that appear in more than one log delivered once.

Rules and billing

Can I share my key with my team or resell access?

No. Access belongs to one customer, and the address limit counts every key of an account together, so a key passed around stops working for new addresses. Sharing or reselling access is not allowed and gets the keys revoked.

What happens when I change tier or stop sponsoring?

A tier change on GitHub changes what your existing keys can use, with no new key needed. When you stop sponsoring, the keys stop working at the end of the paid period, and you can generate a new one whenever you sponsor again.

Is there an uptime guarantee or a refund?

No. The API is run on a best-effort basis with no uptime guarantee or SLA. If the service is ever shut down, this page will say so at least 30 days in advance. Payments, yearly ones included, are not refunded.

What do you store about me?

Your GitHub id and login, your sponsorship, a hash of each key, and the addresses your keys were used from in the last 30 days. Payment details stay with GitHub. The privacy page has the details.

How do I get help?

Write to [email protected]. Support is best effort, without a guaranteed response time. Bugs in the server itself go to GitHub issues.

Want to run it yourself? See the quick start or the certstream-server-rust repository.