Ahrefs vs SpyFu API

Ahrefs 58

The newest changelog entry read is 1 October 2026, 34 days before this check, so recency moves from 30 to 20 on time alone. The changelog is per the 8 October check, not re-read on 4 November under the terms pause, so a newer entry can't be read. Dated entries since 6 August read on 8 October include 10 August, 4 September, 22 September and 1 October, at least three (20). A public changelog and support by email and live chat. No public issue tracker or developer forum found (9). The official Python SDK is alpha, last tagged v0.9.0-alpha on 22 March 2026 with no commit since, and not on PyPI. The local MCP package @ahrefs/mcp is marked unmaintained, its last commit 19 February 2026 documenting the deprecation (5). The SDK repository has a CI workflow, with no commits since March (4). 20+20+9+5+4 = 58.

SpyFu API 16

Closed service. No changelog. The newest dated docs change found is 13 July 2026 (the rate-limits and pricing pages' updatedAt), 116 days before this check (10). Reference pages are dated between August 2025 and 9 July 2026, so fewer than three dated changes in 90 days (0). A help centre and support email, with no public changelog or tracker (6 of 15). No official SDK (0). No package to judge (0). 10+0+6+0+0 = 16.

Ahrefs 67

Findings per the 8 October check, not re-read on 4 November (terms pause), except the terms, re-read on 4 November (last modified 14 September 2026, unchanged). Closed service with published terms, last modified 14 September 2026. The Python SDK is MIT (15). Privacy policy (4 August 2026), DPA (15 September 2025) and a sub-processor list (13 May 2026). Retention is stated as 'as long as is necessary' with no periods. Section 13.3 of the terms lets Ahrefs train models on user content, with an opt-out for Enterprise per the pricing page. The privacy policy says data is stored in the United States while the sub-processor list names AWS in the USA and Singapore (17). No deprecation policy for the API. API v2 was retired on a stated date (1 November 2025) and one 2026 removal had four weeks' notice, while others were same-day. The Ahrefs Connect terms promise 30 days' notice for material reductions (8). 37 sub-processors listed with country (18).

SpyFu API 38

Closed service under terms naming SpyFu, Inc., updated 25 February 2019, under Arizona law (15 of 30). The privacy policy carries no date, retention periods, controller or named processors, and says data is moved to the United States (5 of 30). No deprecation policy or notices found (0 of 20). No subprocessors named; data location is the United States (3 of 20). 15+5+0+3 = 23.

Ahrefs 35

Graded on API v3, the surface a script or headless agent may use, with the hosted MCP server noted where it differs. Ahrefs' terms bar automated use of its websites other than through the API, so docs.ahrefs.com and ahrefs.com weren't re-read on 4 November and their findings are per the 8 October check, not re-read on 4 November. No status page (0) and no incident history (0). status.ahrefs.com returned 404 and no status link was found on the site, docs or legal pages. A default limit of 60 requests a minute is published (15). The docs say 429 is returned over the limit and also under dynamic throttling. The official Python SDK's README, re-read on 4 November, says it retries 429 respecting Retry-After with exponential backoff and jitter. No idempotency keys or safe-retry guidance for the write endpoints, so backoff guidance alone (10). No SLA found, and section 4.8 of the terms says interruptions may occur (0). API v3 has been released since 8 September 2022 and the MCP page carried no beta label (10).

SpyFu API 45

Hosted lines. No status page found; status.spyfu.com did not resolve and the docs link none (0). No incident history to read (5). Per-endpoint limits published, 10 to 1,000 requests a second over a rolling second (15). 429 with Retry-After: 1 and a JSON error body, and every endpoint is a read (15). No SLA found (0). Generally available (10). 0+5+15+15+0+10 = 45.

Ahrefs 85

All findings per the 8 October check, not re-read on 4 November (terms pause). One OpenAPI 3.2.0 document covers all 153 operations, with a spec per tool and a JSON index (25). llms.txt and a Markdown copy of each guide (10). Every operation has a summary or description, free endpoints are marked and field descriptions carry their unit cost, but few say when to use one report over another (14). 407 enums, defaults and formats, though select, where and order_by are plain strings and where is a JSON filter expression passed as a string (10). 400, 401, 403, 429 and 500 are declared on every operation, but the error schema is a single error string. Request examples sit in the guides more than the spec (8). A dated changelog back to 2022, with removals and renames landing inside v3 (13).

SpyFu API 75

Every reference page embeds an OpenAPI 3.1 definition with security schemes and responses, but no single downloadable file is linked (20 of 25). llms.txt and a Markdown twin of every page (10). Descriptions say what each endpoint returns and how it differs from its neighbours ('unlike term-based endpoints...') (17 of 20). Typed parameters with descriptions, examples and required flags (12 of 15). 200, 400, 401 and 500 in the definitions and a 429 example, little on error bodies (11 of 15). v2 in every path, but no changelog (/changelog answered 404) (5 of 15). 20+10+17+12+11+5 = 75.

Ahrefs 45

Findings on Ahrefs' own pages are per the 8 October check, not re-read on 4 November (terms pause). Bearer API keys in a header, up to 1,000 per workspace, created by owners and admins, each expiring after one year and invalidated when its creator leaves. MCP connections use OAuth with PKCE and get their own key tagged with MCP scope. Keys carry no endpoint or read-only scope (22). No read-only mode or confirmation step found for deleting projects or publishing social posts. A per-key monthly unit cap limits spend, not actions (6). Responses include third-party anchors, titles, page text and AI answers, and no prompt-injection guidance was found (0). The keys page shows each key's creator and expiry and the usage page shows consumption. An audit log is listed for Enterprise only (8). ISO 27001 is claimed on the Enterprise page, and the Python SDK's SECURITY.md (re-read on 4 November) sends reports to privacy@ahrefs.com with no acknowledgement time. No security.txt, no bug bounty found, and the trust site needs JavaScript we couldn't run (9).

SpyFu API 52

An API ID and secret key, sent by Basic auth or by a timestamped HMAC signature, with no scopes found (22), less 10 for the documented api_key query parameter (12 of 30). The API only reads (15 of 20). Ad copy, page titles and SERP data are third-party text, with no prompt-injection guidance (5 of 15). The Account API reports usage by month, day and method (12 of 15). A vulnerability disclosure policy with safe harbour and response targets; security.txt returns 404 and no certification or bug bounty was found (8 of 20). 12+15+5+12+8 = 52.