Perplexity Search API vs SerpKite

Perplexity Search API 56

Project API keys, shown once, revocable, and generated and revoked through two documented endpoints with a rotation guide. No per-key scopes or spending limits were found. The hosted MCP server also takes Sign in with Perplexity (OAuth). Keys go in the Authorization header only (22 of 30, as on the Decisions API listing). Search only reads, and MCP clients can disable tools, but any key reaches every API on the account, including the Agent API's sandbox and MCP tools (8 of 20). Snippets are third-party page text, and no guidance on treating them as untrusted was found in the docs, the MCP server or its SECURITY.md (0 of 15). Responses carry a request id, and the console shows usage by key. The Audit API covers enterprise organisations' web app events with its own keys, not API calls (8 of 15). security.txt valid until 31 December 2027 linking a security page, a SOC 2 Type II report, a 2025 HIPAA gap assessment and a CAIQlite listed on the trust centre, and a SECURITY.md on the MCP server that takes private reports through GitHub advisories or security@perplexity.ai. The trust centre is drawn by script and wasn't read (18 of 20). 22 + 8 + 0 + 8 + 18 = 56.

SerpKite 37

Many keys per account, each revocable and rotatable with an optional monthly credit limit, stored as SHA-256 hashes, with no scopes. Since 9 October the MCP server also takes OAuth (authorisation code with PKCE, dynamic client registration, rotating refresh tokens, one mcp scope), each connection running as a named, revocable API key, while REST still needs a key (20). The docs allow the key as ?api_key= on GET requests (minus 10). Search is read-only, and per-key limits and an account spend cap bound cost, but there's no read-only key, and the MCP server exposes crawl alongside search with no confirmation step we could see (10). Results include third-party snippets and full page Markdown, and we found no prompt-injection guidance (0). The dashboard request log keeps per-call metadata (endpoint, status, credits, key) for 31 days with CSV export, and each key records who created it (12). security.txt returns 404. The security page has a disclosure policy with acknowledgement in 2 business days, no paid bug bounty and SOC 2 marked as not yet started (5).

Perplexity Search API 25

No x402, MPP or L402 in the docs, pricing page, OpenAPI or llms.txt (0). $5 per 1,000 successful requests, $1 with Fast Search, published without a login, with failed and rate-limited requests not billed (20). Usage is prepaid with a card on the billing page, and no free allowance was found. The console playground needs no key but is a page for a person, not an API allowance (0). A person signs up in the console. The Stripe Projects route provisions a project, key and credits from a terminal, but needs a person's Stripe account with a payment method and a $10 minimum purchase (5 of 20, as on the Decisions API listing). 0 + 20 + 0 + 5 = 25.

SerpKite 40

No x402, MPP or L402 in llms.txt, the OpenAPI spec or the pricing page (0). Per-pack and per-credit prices published without a login, $1.00 to $0.60 per 1,000 (20). Free credits on signup and 1,000 a month with no card, per the quickstart and home page (20). A person signs in by email, GitHub or Google in a browser (0).

Perplexity Search API 85

max_results 1 to 20, max_tokens and max_tokens_per_page cap the extracted text, and results are title, url, snippet and two dates. The MCP server has four tools (23 of 25). Domain, language, recency, publication and update date filters and country, with up to five queries in one request. No pagination or offset (16 of 20). 429 bodies name the limit hit, the SDKs map status codes to typed errors, and 402 marks an empty balance. Search-specific error bodies beyond 422 validation are not documented (13 of 20). Searches only read, failed and rate-limited requests are not billed, and the MCP server sets readOnlyHint true, destructiveHint false and idempotentHint false on every tool (18 of 20). Only query is required. Official Python and TypeScript SDKs, a CLI and a Python Search SDK (15). 23 + 16 + 13 + 18 + 15 = 85.

SerpKite 97

format=markdown or compact, fields projection, num and an X-Tokens-Estimate header size REST responses. The MCP server now has 23 tools with no toolsets or read-only subset we could find (22). page, num up to 100, country, language, location, time, domain include, exclude and boost, date bounds, highlights and max_tokens on extract (20). Stable error codes with a retry column, and errors are never billed (20). Searches are read-only, failed and empty calls are refunded, and batch creation takes Idempotency-Key. Since 9 October 2026 the changelog says every MCP tool carries readOnlyHint, destructiveHint, idempotentHint and openWorldHint, with all read-only except crawl, and on 2 November the MCP page says every tool is read-only except crawl and research, which start paid tasks, and none is destructive (20). Only q or url is required, and official SDKs exist for TypeScript, Python and Go with retries built in (15). 22+20+20+20+15 = 97.

Perplexity Search API 66

Closed service under terms naming Perplexity AI, Inc. and California law. The MCP server is MIT and the SDKs Apache-2.0 (18 of 30). The terms and DPA say Customer Content and personal data don't train Perplexity's models, the DPA deletes personal data within 30 days of the service ending, and the Privacy and Security page says retention varies by API and zero data retention is not the default. The DPA also says Perplexity Search may follow different data terms, which weren't found, and no retention period for search queries is stated (15 of 30). Sonar Chat Completions support ended on 27 September 2026 with a migration guide and requests reformulated rather than refused, and sonar-reasoning was removed on 15 December 2025 with a named replacement. Notices are dated by month and there is no standing notice period beyond the terms' 30 days for termination (10 of 20). A sub-processor list on the trust centre, which is drawn by script and wasn't read, ten business days' notice of new non-model subprocessors, and SCCs for EU and UK transfers. No data location is stated (8 of 20). 18 + 15 + 10 + 8 = 51.

SerpKite 77

Closed API under terms that name the operator, an Ontario address and governing law, with the SDKs and the MCP connection repository MIT (18). The privacy policy, DPA page, retention doc and security page agree that query text of successful requests isn't logged, usage metadata lasts 31 days and batch results 24 hours. On 26 October failed and empty requests began keeping their query for 24 hours, and the changelog says the privacy policy, terms and DPA were updated the same day (27). The terms promise 30 days' notice before removing an endpoint, with exceptions for changes forced by a third party. AI Overview, AI Mode and Lens were removed in the first week without notice under that exception, and the reviews limit of 16 October came the same way, while a batch price change for 23 November 2026 was announced ahead (14). Subprocessors named with purpose and location, including Contabo in Germany, Cloudflare, Paddle, Resend, PostHog EU and Better Stack, with 30 days' notice of changes (20).

Perplexity Search API 80

Graded on the hosted lines, for POST /search and the hosted MCP server. status.perplexity.com, on incident.io since 10 September 2026, has an API component with an RSS feed and a JSON summary. There is no separate Search component (20). In the 90 days from 8 August the feed lists 'Investigating API issue' on 13 August, resolved with no detail, a usage-based billing issue on 3 September, and on 9 October elevated errors on the website, app and Computer, where the API 'remained operational throughout'. Minor only, with the caveat that history before the migration may be incomplete (20). The Search API is limited to 50 query units a second with a burst of 50 on every tier, and the other APIs publish QPS and token limits per tier (15). 429 carries Retry-After and an error.type, the SDKs retry 429 and 5xx twice honouring Retry-After, the Search best-practices page shows backoff, and failed or rate-limited searches are not billed. Searches have no side effects (15). The FAQ says Perplexity does not guarantee uptime, failure frequency or recovery time, and the terms carry no SLA (0). No beta label on the Search API, launched on 25 September 2025 (10). 20 + 20 + 15 + 15 + 0 + 10 = 80.

SerpKite 75

Hosted API, read with the hosted lines. Better Stack status page at status.serpkite.com with four monitors (api.serpkite.com/healthz, dashboard API, dashboard, website) and daily bars (20). Monitoring began on 2 October 2026, so the record covers 31 days of the 90 from 4 August. The page's own figures give 99.978 per cent uptime over 30 days for the API health monitor and 99.971 for the dashboard API, the 5 October check saw 29 to 41 minutes of downtime on each monitor on 2 October and 19 seconds on 3 October, and the feed has never carried an incident post. No outage reached an hour. A readable record shorter than 90 days with nothing major scores 15, as this run settled for short records. Rate limits published per key, 5 to 100 requests a second by pack (15). 429 rate_limited with Retry-After, backoff guidance for 429 and 503, and Idempotency-Key on batch creation (15). The terms say self-serve plans have no uptime guarantee and an enterprise SLA sits in a separate agreement we couldn't read (0). v1 API with no beta or preview label (10). 20+15+15+15+0+10 = 75.