API for agents and LLMs
This is not a separate API — it is the exact surface the browser calls when you run the speed test on this site, documented so a script, an agent or an LLM tool can call it too. No key, no sign-up, no CORS.
There is no separate "public API" here: these are the same four endpoints the browser on this site calls to run a speed test, with no API key, no account, and — see below — no CORS header.
Endpoints
/api/speed/pingUnmeteredA minimal round-trip probe.
The t field in the response is diagnostic only. Workers freeze Date.now() between I/O operations, so it is not a trustworthy clock for measuring latency — time the request yourself.
/api/speed/metaUnmeteredReflects what Cloudflare sees about the caller: IP, ISP, ASN, city, country, and the edge (colo) that answered.
Nothing here is stored. It is echoed back to the caller and nowhere else.
/api/speed/down600 tokens / hour / IPStreams bytes (query parameter, default 1 MB, capped at 100 MB) of random data, for download-throughput measurement.
The response is no-store, no-transform — nothing compresses or caches it, either of which would inflate a measured speed.
/api/speed/up600 tokens / hour / IPAccepts a request body of up to 100 MB and reports how many bytes arrived and how long that took, for upload-throughput measurement.
A declared Content-Length above 100 MB is rejected with 413 before the body is read.
The rate limit, as arithmetic
/api/speed/down and /api/speed/up share one bucket of 600 tokens per IP, refilling at one token every 6 seconds. That is roughly 10 full speed tests an hour — a full test uses well under 60 requests. /api/speed/ping and /api/speed/meta are unmetered: their payloads are trivial, and metering them would add a KV read to the exact path they exist to measure.
The largest single request either endpoint will serve or accept is 100 MB.
No CORS — on purpose
These endpoints send no Access-Control-Allow-Origin header, and none of them sit behind the same-origin check this site uses on its account and billing routes. That combination is deliberate: a server-side caller — curl, an agent, an LLM tool — already works today, while a browser running cross-origin JavaScript against these endpoints is already blocked by the browser itself. Adding * CORS would let any website spend this site’s bandwidth from its own visitors’ browsers; documenting the current shape costs nothing and changes nothing.
A worked example — curl
Download 5 MB and time it — the standard shape of a manual throughput check.
curl -o /dev/null -w "%{time_total}s for %{size_download} bytes\n" \
"https://mysygnal.net/api/speed/down?bytes=5000000"A worked example — an agent or LLM tool
The same measurement, timed by the caller rather than trusted from the response — see the note on /api/speed/ping above.
const t0 = performance.now();
const res = await fetch("https://mysygnal.net/api/speed/down?bytes=5000000");
await res.arrayBuffer();
const seconds = (performance.now() - t0) / 1000;
const mbps = (5_000_000 * 8) / seconds / 1_000_000;Everything else this site offers a caller
llms.txt indexes the tools, the guides and every router page on this site in one plain-text file, meant to be read by a model rather than a browser.