Two URL styles
Both are accepted on the same host, so most existing links work by changing the hostname alone.
https://cdnjs.vappcdn.com/ajax/libs/<library>/<version>/<file>
https://cdnjs.vappcdn.com/<package>@<version>/<path>Notes
- Versions are explicit. There is no floating “latest” — a URL that worked yesterday returns the same bytes today.
- Files are resolved from the official package registry, so a library that publishes there is available here without us curating a list.
- Scoped packages work:
/@scope/name@1.2.3/dist/index.js. - The index above is a curated shortlist for browsing; any published package resolves whether or not it appears here.
Endpoints
| Path | Purpose |
|---|---|
/ajax/libs/… | Library-style asset URL. |
/<pkg>@<ver>/… | Package-style asset URL. |
/api/libraries.json | The index this page searches. |
Questions
How do I verify you served me the right bytes?
Every package view gives you an integrity attribute. The browser recomputes the hash and refuses the file if a single byte differs, so you do not have to take our word for it — a substituted or tampered asset fails closed instead of executing. Check it yourself against the registry:
curl -s <url> | openssl dgst -sha384 -binary | openssl base64 -AWill a URL keep working?
Versions are explicit and immutable, so a URL that worked yesterday returns the same bytes today. There is no floating “latest” to move under you. If a version is unpublished upstream we keep serving the copy we already hold rather than breaking your page.
What happens if the international link goes down?
Assets already held here keep serving, and search keeps working, because both are stored on this server rather than fetched on demand. Something never requested before cannot be served — we would be lying if we claimed otherwise.
Which URL styles work?
Three, so most existing links work by changing the hostname alone:
/ajax/libs/<library>/<version>/<file>
/<package>@<version>/<path>
/npm/<package>@<version>/<path>Scoped packages work in all three — /@scope/name@1.2.3/dist/index.js. Repository-style URLs that serve arbitrary source hosts are not supported: without a publication step or immutable versions they are a different trust model from a package registry.
Is every package listed?
No. The browsable list is a curated shortlist, and packages with no browser-linkable build are deliberately left out rather than listed with a link that 404s. Any published package still resolves by URL whether or not it appears here.
Are there rate limits?
No per-request limits today. If that changes it will be documented here before it is enforced.
Get started
Create an account and manage your zones and assets from the dashboard.
Open the dashboard