App attribution headers

Use HTTP-Referer / X-EveryAIS-Title / X-EveryAIS-Category to list your app in the public app rankings, and what we do and do not store.

List the app you built on everyais in the public app rankings (https://everyais.com/apps) and in the "Apps using this model" section of every model page. Add three headers to your requests — there is no application or approval step.

Responses, billing and rate limits are unaffected. These headers are not used for routing, authentication or pricing — only for aggregation.

⚠️ These values are self-reported and unverified. We do not check that you own the address, so a name next to a domain in the listing means "that app reported it", not something everyais vouches for.

Headers

Header	Required	Value
`HTTP-Referer`	Yes	Your app's public https address. Without it there is no attribution at all
`X-EveryAIS-Title`	No	Display name for the listing (max 64 characters)
`X-EveryAIS-Category`	No	One of the fixed values below

curl https://api.everyais.com/v1/chat/completions \
  -H "Authorization: Bearer $EVERYAIS_API_KEY" \
  -H "Content-Type: application/json" \
  -H "HTTP-Referer: https://your-app.com" \
  -H "X-EveryAIS-Title: Your App" \
  -H "X-EveryAIS-Category: cli-agent" \
  -d '{"model": "everyais/claude-opus-5", "messages": [{"role": "user", "content": "hi"}]}'

With the OpenAI SDK, set them once as default headers.

from openai import OpenAI

client = OpenAI(
    api_key="everyais_...",
    base_url="https://api.everyais.com/v1",
    default_headers={
        "HTTP-Referer": "https://your-app.com",
        "X-EveryAIS-Title": "Your App",
        "X-EveryAIS-Category": "cli-agent",
    },
)

Supported on /v1/chat/completions, /v1/messages and /v1/responses, streaming or not. These are not aggregated yet:

Image and video requests (/v1/images/*, /v1/videos/*)
/v1/responses calls with background: true, which return immediately and settle elsewhere

Aggregation is best-effort. Even with the headers set correctly some requests may not reach the ranking; that difference never affects billing or the response you get.

How HTTP-Referer is stored

The value is not stored verbatim — it is folded to an origin. https://your-app.com:8443/chat?id=42 becomes https://your-app.com: port, path, query and fragment are dropped before storage. The host is lowercased, internationalised domains are normalised to punycode, and trailing dots are stripped.

The following are not aggregated (the request still succeeds):

Anything that is not https. That covers javascript:, data: and file:, and plain http is rejected too — allowing both would make http://your-app.com and https://your-app.com separate entries that render identically, so anyone could create an entry indistinguishable from yours
Values that do not parse as a URL
Hosts that are IP addresses — public ones included. That is a server address, not an app
Dotless hosts such as localhost, and anything ending in .local, .localhost, .internal or .home.arpa
Addresses with an empty label, such as .your-app.com
Origins longer than 64 characters — truncating one would invent an address that does not exist

Display names have control characters and <, > removed, runs of whitespace collapsed to a single space, and are cut to 64 characters. If the value contains anything shaped like an email address, the display name is dropped entirely.

⚠️ The standard Referer header that browsers send automatically is not read. Attribution only happens when you set HTTP-Referer deliberately, so nobody is listed without knowing.

Privacy

What the aggregate stores is the (date, app origin, model) combination plus its request and token counts. Nothing else.

Who sent the request (user id, API key, organization) is never joined to this aggregate.
Request bodies (prompts and completions) never enter it.
Path and query string are stripped before storage, so identifiers embedded in a URL do not survive.
Send no headers and no app information is recorded at all.

Aggregation is per UTC day and the public query window is the last 30 days.

GET /models/apps

Apps using one model. No authentication and no /v1 prefix. 60 req/min per IP, and the response carries Cache-Control: public, max-age=60, s-maxage=300, stale-while-revalidate=300.

The 60 req/min limit is per IP and is a budget shared by a group of paths. /models/estimate, /models/stats, /models/benchmarks, /models/benchmarks/overview, /models/rankings, /models/apps, /models/apps/top, /models/changes and /models/feed.xml all draw from one bucket, so a screen that calls several of them in a row spends the budget that much faster. /models/catalog has its own separate bucket, so catalog reads keep working even when the detail calls have exhausted theirs.

Only approved, active models can be queried; anything else returns 404 model_not_found. Model slugs contain slashes, so the model goes in a query parameter rather than the path. limit defaults to 20 and is clamped to 1–50 — out-of-range values are folded, not rejected.

curl "https://api.everyais.com/models/apps?model=everyais/claude-opus-5"

{
  "model": "everyais/claude-opus-5",
  "window_days": 30,
  "apps": [
    {
      "app_id": "https://your-app.com",
      "title": "Your App",
      "category": "cli-agent",
      "tokens": 128400,
      "requests": 312
    }
  ]
}

Field	Meaning
`app_id`	The normalised origin. Shown as-is when no display name was reported
`title`	Reported display name, or null if never reported
`category`	One of the fixed values, or null if never reported
`tokens`	Input + output tokens inside the window
`requests`	Requests inside the window

Sorted by tokens, then requests, then app_id.
No apps is an empty array, not a 404. Most models have no attributed apps, so "no apps" and "no such model" have to stay distinguishable.

GET /models/apps/top

The same data pivoted by app — the global ranking behind everyais.com/apps. It takes no model parameter; authentication, rate limit, caching and limit behave exactly as above.

curl "https://api.everyais.com/models/apps/top?limit=20"

total_tokens is the total before limit truncation, so it can exceed the sum of the listed rows. Only attributed traffic is counted, so this is not total everyais usage.

Traffic on models outside the public catalog (inactive, unapproved, or without settled pricing) is excluded from both the ranking and the total.