fatsecret Platform API vs spoonacular

fatsecret Platform API 51

OAuth 2.0 client credentials with seven scopes gating capabilities (basic, premier, barcode, localization, nlp, image-recognition and feedback), tokens of 86,400 seconds, a Client Secret that stays on the server, and token requests limited to IP addresses or CIDR ranges registered on the key; OAuth 1.0 with HMAC-SHA1 remains for delegated calls. The scopes gate capabilities rather than read or write, and no rotation procedure was found (26 of 30). Per-user data is reached only through a delegated profile token, and the shared data methods are reads, but there is no read-only scope and no confirmation step for diary writes (14 of 20). Food and brand names are verified by fatsecret and recipes are its own content, with no guidance on treating them as untrusted (8 of 15). No request log or per-call visibility was found beyond the dashboard (3 of 15). The security.txt path answered the site's generic error page, and no disclosure policy, bug bounty or certification was found (0 of 20). 26 + 14 + 8 + 3 + 0 = 51.

spoonacular 20

One key per account with no scopes, expiry or rotation procedure, documented first as the apiKey query parameter and also sent in the query string by the MCP server; the x-api-key header is the alternative. One all-powerful key (10) less 10 for the documented query string (0 of 30). The data endpoints are read-only and a user's meal plan is written only with that user's username and hash, but there is no read-only key mode or confirmation step (10 of 20). Recipe text, instructions and extracted pages come from third-party websites and no guidance on treating them as untrusted was found (5 of 15). The console shows quota use and the headers report it per call, but no request log was found (5 of 15). security.txt returns 404 and no disclosure policy, bug bounty or certification was found (0 of 20). 0 + 10 + 5 + 5 + 0 = 20.

fatsecret Platform API 34

Closed service with terms that are clear on caching, attribution, rate limits and termination, but undated, naming the provider only as Fatsecret.com, and changeable with or without notice (12 of 30). The privacy policy on foods.fatsecret.com could not be read, because that host's robots.txt disallows our reader, so no data-handling statement was scored; the terms require content to be removed within 24 hours (0 of 30, unchecked). Older method versions stay documented alongside v5 and foods.search v4 is still served, but the terms allow any aspect of the API to be changed or discontinued at any time with no notice period (6 of 20). No subprocessors or data locations found (0 of 20). 12 + 0 + 6 + 0 = 18.

spoonacular 61

Closed API with terms last updated 16 April 2026 that are clear on caching, attribution and termination; the MCP server is ISC and the clients MIT (15 of 30). The privacy policy, last revised in 2023, names Stripe and unnamed third parties, gives no retention periods and no DPA, while the terms require deleting all data when access ends (10 of 30). The terms allow the API to end without notice, but the updates page records field renames and removals with six months' notice, the last in 2022 (8 of 20). Cloudflare is named on the marketing page and Stripe in the privacy policy, with no subprocessor list or data location (5 of 20). 15 + 10 + 8 + 5 = 38.

fatsecret Platform API 35

Read with the hosted lines. No status page was found on the platform site, the guides, the editions page or the about page (0), so there is no incident history to read (5). The limit is published with a number, 5,000 calls a day on Basic in the terms and on the editions page, and Premier is unlimited (15). Limits surface as error codes 11 and 12 in the body; no HTTP 429, Retry-After or backoff guidance was found, and diary writes have no idempotency key (5 of 15). Premier carries a month-by-month SLA with service credits, named on the editions page without figures, and every edition claims more than 99.9 per cent uptime (5 of 10). The API is generally available, with versioned methods (10). 0 + 5 + 15 + 5 + 5 + 10 = 35.

spoonacular 58

Read with the hosted lines. A status page exists at status.spoonacular.com (UptimeRobot), but on 3 November 2026 it rendered 'There was an error while fetching the data' with no components or history, so half credit (10 of 20) and no readable incident record (5). Daily point quotas and requests-per-second limits are published by plan, 60 a minute on Free and 5, 10 and 20 a second on Cook, Culinarian and Chef (15). HTTP 429 and 402 are documented with three quota headers, but there is no Retry-After, backoff guidance or idempotency key for the meal-plan writes (8 of 15). The pricing page states 99 per cent uptime on Cook and Culinarian and 99.9 per cent on Chef, and the FAQ says SLAs are sold above $250 a month (10). The API is generally available (10). 10 + 5 + 15 + 8 + 10 + 10 = 58.

fatsecret Platform API 25

No x402, MPP or L402 (0 of 40). Basic is free and Premier is priced on request by market, with add-ons billed in tiers of 25,000 inputs and no price given, so the paid prices are contact sales (5 of 20). Basic is free on self sign-up with no card, and the platform page says Premier needs no upfront payment or card (20 of 20). A person registers in a browser and Premier goes through sales; no key API was found (0 of 20). 0 + 5 + 20 + 0 = 25.

spoonacular 40

No x402, MPP or L402 (0 of 40). Plan prices and per-point overage rates ($0.005, $0.004 and $0.002) are public, with the point cost of every endpoint (20). The Free plan gives 50 points a day with no card (20). A person signs up in the console in a browser, and no key API exists (0 of 20). 0 + 20 + 20 + 0 = 40.

fatsecret Platform API 52

No OpenAPI or similar document was found; the official Postman collection is the only machine-readable contract (8 of 25). No llms.txt (a redirect) and no Markdown docs (0 of 10). Each method page states purpose, parameters, response fields and Premier status, with little on when not to use a method (12 of 20). Parameters are typed with defaults and allowed values, max_results is capped at 50, but the field tables mistype allergen names as Long and leave food_images out of the food-level fields (11 of 15). Example responses in XML and JSON on each method, a central error code list with the body shape, and per-method error codes (13 of 15). Methods carry versions (v1 to v5) and older versions stay documented, but no changelog is on the platform site and the blog's 'What's new' could not be read (8 of 15). 8 + 0 + 12 + 11 + 13 + 8 = 52.

spoonacular 65

Public OpenAPI 3.0.0 document (info version 2.0.2, 97 paths, 99 operations) in the vendor's spoonacular-api-clients repository, linked from the SDK page, and the MCP server's six tools carry JSON Schema inputs (25). No llms.txt (404) and no Markdown docs (0 of 10). Each endpoint states its purpose and point cost, with little on when not to use it (12 of 20). Parameters are typed with required flags, number is bounded, but diet, cuisine, intolerance and meal-type values sit in prose lists rather than enums (9 of 15). Request and response examples on every endpoint, 402 and 429 documented in the quota text, but the OpenAPI document lists only 200, 401, 403 and 404 and no error body shape (9 of 15). No version in the path; a dated updates page by month back to February 2020 records field removals with notice, the last in December 2022 for 30 June 2023 (10 of 15). 25 + 0 + 12 + 9 + 9 + 10 = 65.

fatsecret Platform API 13

Read as a closed service. No dated API change could be read first-hand. The blog that carries the 'What's new' notes sits behind a robots.txt that answered 403, the method pages are undated, and the official Postman repository's last push is 1 July 2025, more than 180 days before 3 November 2026 (0 of 30). No three dated changes in 90 days established (0 of 20). A developer forum on Google Groups, a contact form, and email, phone, Slack and video support on Premier, with no public changelog on the platform site (8 of 15). No official SDK; an official Postman collection (5 of 15). No package to assess (0 of 10). 0 + 0 + 8 + 5 + 0 = 13.

spoonacular 22

Read as a closed service. The newest dated change on the updates page is February 2026 (Nutrition by Photo, recipe extraction from video), more than 180 days before 3 November 2026, and the SDK repository's last push is 2 December 2025 (0 of 30). No dated changes in the last 90 days (0 of 20). Updates page, Discord, contact form and paid support from $99 a month; three open issues on the clients repository could not be read (8 of 15). Generated SDKs in 24 languages, last pushed December 2025, and an npm MCP server, but no vendor entry in the official MCP registry, which lists only third-party spoonacular servers (10 of 15). spoonacular-mcp has one release (1.0.0, 4 August 2025), a test script and no CI (4 of 10). 0 + 0 + 8 + 10 + 4 = 22.