Integrate Moz with Bolt.new using the Moz Links API and Moz URL Metrics API through an API route that keeps your Moz API credentials server-side. Fetch domain authority scores, page authority, spam scores, and backlink data for any URL. Moz's API uses simple token-based authentication over HTTPS — all calls work from Bolt's WebContainer preview. Build SEO audit dashboards and domain analysis tools with Moz data surfaced directly in your Bolt app.
Build SEO Authority Tools in Your Bolt.new App with Moz API
Moz is the creator of Domain Authority (DA) — the 100-point logarithmic scale that has become the industry-standard metric for measuring a website's overall ranking strength. When SEO professionals, content marketers, and digital agencies talk about a site's authority, they're usually referring to Moz's DA score. Integrating Moz into your Bolt.new app gives you access to this authoritative data programmatically — enabling you to build SEO audit tools, competitive analysis dashboards, link prospecting systems, and client reporting portals.
The Moz API provides two main data streams that power most use cases. The URL Metrics API returns a bundle of authority metrics for any URL: Domain Authority (DA), Page Authority (PA), Spam Score, linking root domains count, and total links count. These metrics are the foundation of any SEO analysis — you can analyze a single URL, bulk-process lists of prospects, or monitor a client's authority trends over time. The Links API goes deeper, returning the actual backlink profile: which domains link to a target URL, the anchor text used, and the authority of the linking pages.
Moz's free tier provides limited monthly API rows — enough for development and light usage. Paid plans unlock higher monthly limits for production tools. The API uses simple token-based HTTP Basic Auth with no OAuth flow to manage, making it one of the simpler SEO APIs to integrate. Since all calls are standard HTTPS requests, they work perfectly from Bolt's WebContainer during development — no deployment or special configuration needed for outbound data fetching.
Integration method
Moz integrates with Bolt.new through a Next.js API route that authenticates with Moz's API using HTTP Basic Auth (access ID and secret key) and fetches URL metrics, domain authority scores, and backlink data. All Moz API calls are outbound HTTPS requests that work from Bolt's WebContainer preview — no native modules, no incoming connection requirements. The Moz API has tiered rate limits based on your plan; caching results in Supabase reduces API calls for frequently analyzed URLs.
Prerequisites
- A Moz account at moz.com (free account available, paid plan for higher API limits)
- Moz API access token: Access ID and Secret Key from moz.com/products/mozscape/access
- A Bolt.new project with Next.js for API routes
- Supabase connected to the Bolt project (for caching Moz API results)
- Understanding of Moz's API row pricing model — each URL metric fetch consumes rows against your monthly limit
Step-by-step guide
Get Your Moz API Credentials
Get Your Moz API Credentials
Moz provides API access through their Mozscape API, which they also call the Moz Links API. To get credentials, you need a Moz account with API access enabled. Go to moz.com and create an account if you don't have one — the free tier includes a limited number of API rows per month (enough for development and testing). Once logged in, navigate to moz.com/products/mozscape/access or go to your Moz account settings and look for the API section. You'll find two credentials: an Access ID (a string like `mozscape-xxxxxxxxxx`) and a Secret Key (a longer token string). These two values are used together as HTTP Basic Auth credentials — the Access ID is the username and the Secret Key is the password. Unlike OAuth-based APIs, there's no token expiry or refresh flow — the credentials are permanent until you reset them. Moz's API base URL is `https://lsapi.seomoz.com/v2/`. Copy both credentials into your Bolt project's `.env` file. Since these credentials authenticate your Moz account and control your monthly API usage, they must stay server-side — never expose them in client-side JavaScript. The Moz API does not have a separate sandbox environment; all requests hit the production API, but the data returned for any URL reflects Moz's real-world index. Fetching metrics for test URLs like your own domain is a free and safe way to verify the integration works.
1# .env — Moz API credentials2# Found at moz.com/products/mozscape/access after logging in3MOZ_ACCESS_ID=mozscape-your-access-id4MOZ_SECRET_KEY=your-secret-key56# Moz API v2 base URL7MOZ_API_BASE=https://lsapi.seomoz.com/v289# For Next.js server-side: process.env.MOZ_ACCESS_ID10# Never use NEXT_PUBLIC_ prefix — these are server-side only credentialsPro tip: Moz's free tier includes a limited monthly row budget — each URL you analyze consumes rows. Cache results in Supabase with a 24-hour TTL to avoid re-fetching the same URLs and exhausting your monthly allowance during development.
Expected result: You have Moz Access ID and Secret Key stored in your .env file. Test the credentials by calling the Moz API directly from your API route with a domain you know (e.g., your own website).
Create the URL Metrics API Route
Create the URL Metrics API Route
The URL Metrics endpoint is the core of most Moz integrations. It accepts an array of URLs and returns authority metrics for each one: Domain Authority (DA, 1-100 scale measuring overall link authority), Page Authority (PA, 1-100 scale for individual page authority), Spam Score (0-17 scale measuring how likely the domain is penalized), and link counts (linking root domains and total links). Build a Next.js API route that accepts a URL (or array of URLs) from your frontend, authenticates with Moz using Basic Auth, and returns the formatted metrics. The Moz API v2 uses a POST request to `/url_metrics` with a JSON body containing a `targets` array of URL strings. Moz recommends normalizing URLs before sending them — including the protocol (`https://`) and removing trailing slashes for consistent results. The Basic Auth header is computed by base64-encoding `AccessID:SecretKey`. Store the Basic Auth string at module level so it's computed once rather than on every request. Moz's API returns results as an array matching the order of your input targets — this allows batch processing of multiple URLs in a single API call, which is more efficient than individual calls. For production tools analyzing many URLs, batch requests reduce both latency and API row consumption.
Create a Moz URL metrics API route at app/api/moz/url-metrics/route.ts. It should accept POST requests with a JSON body containing either a single url (string) or urls (string[]). Use the MOZ_ACCESS_ID and MOZ_SECRET_KEY environment variables to authenticate with Basic Auth. Call the Moz v2 URL Metrics API at https://lsapi.seomoz.com/v2/url_metrics with the targets array. Return the results with domain_authority, page_authority, spam_score, linking_root_domains, and total_links for each URL. Cache results in Supabase for 24 hours to reduce API calls.
Paste this in Bolt.new chat
1// app/api/moz/url-metrics/route.ts2import { NextResponse } from 'next/server';3import { createClient } from '@supabase/supabase-js';45const MOZ_AUTH = Buffer.from(6 `${process.env.MOZ_ACCESS_ID}:${process.env.MOZ_SECRET_KEY}`7).toString('base64');89function normalizeUrl(url: string): string {10 const trimmed = url.trim();11 if (!trimmed.startsWith('http')) return `https://${trimmed}`;12 return trimmed.replace(/\/$/, '');13}1415export async function POST(request: Request) {16 const body = await request.json();17 const inputUrls: string[] = Array.isArray(body.urls)18 ? body.urls19 : body.url20 ? [body.url]21 : [];2223 if (inputUrls.length === 0) {24 return NextResponse.json({ error: 'url or urls is required' }, { status: 400 });25 }2627 const targets = inputUrls.map(normalizeUrl);2829 const supabase = createClient(30 process.env.NEXT_PUBLIC_SUPABASE_URL!,31 process.env.SUPABASE_SERVICE_ROLE_KEY!32 );3334 // Check cache for all targets35 const yesterday = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString();36 const { data: cached } = await supabase37 .from('moz_metrics_cache')38 .select('*')39 .in('url', targets)40 .gt('cached_at', yesterday);4142 const cachedUrls = new Set(cached?.map((c) => c.url) ?? []);43 const uncachedTargets = targets.filter((t) => !cachedUrls.has(t));4445 let freshResults: Array<Record<string, number | string>> = [];4647 if (uncachedTargets.length > 0) {48 const mozResponse = await fetch(`${process.env.MOZ_API_BASE}/url_metrics`, {49 method: 'POST',50 headers: {51 'Authorization': `Basic ${MOZ_AUTH}`,52 'Content-Type': 'application/json',53 },54 body: JSON.stringify({ targets: uncachedTargets }),55 });5657 if (!mozResponse.ok) {58 const errorText = await mozResponse.text();59 return NextResponse.json(60 { error: `Moz API error: ${errorText}` },61 { status: mozResponse.status }62 );63 }6465 const mozData = await mozResponse.json();66 freshResults = mozData.results ?? [];6768 // Cache fresh results69 const toCache = freshResults.map((result, i) => ({70 url: uncachedTargets[i],71 domain_authority: result.domain_authority,72 page_authority: result.page_authority,73 spam_score: result.spam_score,74 linking_root_domains: result.root_domains_to_root_domain,75 total_links: result.links_to_root_domain,76 cached_at: new Date().toISOString(),77 }));7879 await supabase80 .from('moz_metrics_cache')81 .upsert(toCache, { onConflict: 'url' });82 }8384 // Merge cached + fresh, preserving input order85 const allResults = targets.map((url) => {86 const fromCache = cached?.find((c) => c.url === url);87 if (fromCache) return fromCache;88 const freshIdx = uncachedTargets.indexOf(url);89 return freshResults[freshIdx] ? { url, ...freshResults[freshIdx] } : { url, error: 'not found' };90 });9192 return NextResponse.json({ results: allResults });93}Pro tip: Create the moz_metrics_cache table in Supabase with columns: url (text, primary key), domain_authority (int), page_authority (int), spam_score (numeric), linking_root_domains (bigint), total_links (bigint), cached_at (timestamptz).
Expected result: POST to /api/moz/url-metrics with { url: 'https://example.com' } returns domain authority, page authority, spam score, and link counts. Results are cached in Supabase for 24 hours.
Build the SEO Audit Dashboard UI
Build the SEO Audit Dashboard UI
With the URL metrics API route in place, build the frontend dashboard that makes this data useful. The dashboard needs a URL input field, a way to show loading state during the API call, and a clear visual display of the returned metrics. Domain Authority is the headline metric — display it prominently with color coding based on the score range. SEO professionals use these rough benchmarks: DA 1-29 is low authority (new or weak sites), DA 30-49 is moderate authority (established sites with some link equity), DA 50-69 is high authority (well-established, significant link profiles), and DA 70+ is very high authority (major publications, authority brands). Spam Score deserves attention too — a score of 10+ indicates potential quality issues with the domain's link profile. Display metrics as visual cards with icons rather than raw numbers to make the dashboard accessible to non-technical users like marketing teams and clients. For the bulk URL feature, add a textarea for pasting multiple domains (one per line), parse them client-side, and send the array to your API route in a single batch request. The Moz API supports up to 50 URLs per request in the v2 endpoint — process larger lists in batches of 50 with a small delay between requests to respect rate limits.
Build an SEO audit dashboard page at app/seo-audit/page.tsx. Add a text input for a single URL and a 'Analyze' button. On submit, call POST /api/moz/url-metrics with the URL. Show a loading spinner during the request. Display the results as four metric cards: Domain Authority (blue), Page Authority (green), Spam Score (red if over 7, yellow if 4-7, green if under 4), and Linking Root Domains (purple). Add color-coded DA badge (green 50+, yellow 30-49, red under 30). Add an analysis history section below that shows the last 10 analyzed URLs fetched from Supabase.
Paste this in Bolt.new chat
1// components/MozMetricsCards.tsx2'use client';34interface MozMetrics {5 url: string;6 domain_authority: number;7 page_authority: number;8 spam_score: number;9 linking_root_domains: number;10 total_links: number;11}1213function getDAColor(da: number): string {14 if (da >= 50) return 'bg-green-100 text-green-800 border-green-200';15 if (da >= 30) return 'bg-yellow-100 text-yellow-800 border-yellow-200';16 return 'bg-red-100 text-red-800 border-red-200';17}1819function getSpamColor(spam: number): string {20 if (spam <= 3) return 'text-green-600';21 if (spam <= 7) return 'text-yellow-600';22 return 'text-red-600';23}2425export function MozMetricsCards({ metrics }: { metrics: MozMetrics }) {26 const daColor = getDAColor(metrics.domain_authority);2728 return (29 <div className="space-y-4">30 <p className="text-sm text-gray-500 break-all">{metrics.url}</p>31 <div className="grid grid-cols-2 md:grid-cols-4 gap-4">32 <div className={`p-4 rounded-xl border-2 ${daColor}`}>33 <p className="text-xs font-medium uppercase tracking-wide opacity-70">Domain Authority</p>34 <p className="text-4xl font-bold mt-1">{metrics.domain_authority}</p>35 <p className="text-xs mt-1">out of 100</p>36 </div>37 <div className="p-4 rounded-xl border-2 bg-blue-50 text-blue-800 border-blue-200">38 <p className="text-xs font-medium uppercase tracking-wide opacity-70">Page Authority</p>39 <p className="text-4xl font-bold mt-1">{metrics.page_authority}</p>40 <p className="text-xs mt-1">out of 100</p>41 </div>42 <div className="p-4 rounded-xl border-2 bg-gray-50 border-gray-200">43 <p className="text-xs font-medium uppercase tracking-wide text-gray-500">Spam Score</p>44 <p className={`text-4xl font-bold mt-1 ${getSpamColor(metrics.spam_score)}`}>45 {metrics.spam_score}46 </p>47 <p className="text-xs mt-1 text-gray-500">out of 17</p>48 </div>49 <div className="p-4 rounded-xl border-2 bg-purple-50 text-purple-800 border-purple-200">50 <p className="text-xs font-medium uppercase tracking-wide opacity-70">Linking Domains</p>51 <p className="text-3xl font-bold mt-1">52 {metrics.linking_root_domains.toLocaleString()}53 </p>54 <p className="text-xs mt-1">root domains</p>55 </div>56 </div>57 </div>58 );59}Pro tip: Moz DA and PA are logarithmic scores — the difference between DA 80 and DA 90 represents far more link equity than the difference between DA 20 and DA 30. When displaying scores to users, add contextual labels like 'Very High Authority' for 70+, 'High Authority' for 50-69, etc.
Expected result: The SEO audit dashboard displays Moz authority metrics as color-coded cards. Entering any URL returns its Domain Authority, Page Authority, Spam Score, and linking domain count.
Add Backlink Analysis with the Moz Links API
Add Backlink Analysis with the Moz Links API
The Moz Links API provides access to the actual backlink data behind DA and PA scores — showing which specific URLs and domains link to a target, the anchor text, and whether each link is followed or nofollowed. This is valuable for competitive research (analyzing what links your competitors have built), link prospecting (finding sites that link to one competitor to target for your own link building), and link auditing (identifying potentially spammy links pointing to your site). The Links API endpoint accepts a target URL and returns an array of linking page objects, each with the source URL, target URL, anchor text, source page authority, source domain authority, and link attributes (nofollow, sponsored, etc.). The API supports filtering by link type, link status (active vs deleted), and sorting by page authority or anchor text. For most use cases, requesting the top 25-50 links by Page Authority gives the best picture of high-quality backlinks. Like all Moz API calls, this is a standard HTTPS request that works from the WebContainer — build and test the backlink analysis feature in the preview before deploying. Rate limits apply to the Links API separately from URL Metrics, so cache backlink results aggressively (they change slowly) to avoid hitting limits.
Add a backlink analysis feature to the SEO audit dashboard. Create an API route at app/api/moz/links/route.ts that accepts a POST request with a target URL and fetches the top 25 backlinks from the Moz Links API. Return each backlink's source URL, source domain authority, anchor text, and whether it's nofollow. Add a 'View Backlinks' button on the metrics results page that shows the backlinks in a table sorted by domain authority. Add a 'Filter: DA 30+' toggle that hides low-authority links.
Paste this in Bolt.new chat
1// app/api/moz/links/route.ts2import { NextResponse } from 'next/server';34const MOZ_AUTH = Buffer.from(5 `${process.env.MOZ_ACCESS_ID}:${process.env.MOZ_SECRET_KEY}`6).toString('base64');78export async function POST(request: Request) {9 const { url, limit = 25, minDA = 0 } = await request.json();1011 if (!url) {12 return NextResponse.json({ error: 'url is required' }, { status: 400 });13 }1415 const target = url.startsWith('http') ? url : `https://${url}`;1617 const mozResponse = await fetch(`${process.env.MOZ_API_BASE}/links`, {18 method: 'POST',19 headers: {20 'Authorization': `Basic ${MOZ_AUTH}`,21 'Content-Type': 'application/json',22 },23 body: JSON.stringify({24 target,25 target_scope: 'root_domain',26 source_scope: 'page',27 limit,28 sort: 'page_authority',29 }),30 });3132 if (!mozResponse.ok) {33 const errorText = await mozResponse.text();34 return NextResponse.json(35 { error: `Moz API error: ${errorText}` },36 { status: mozResponse.status }37 );38 }3940 const data = await mozResponse.json();41 const links = (data.results ?? []).filter(42 (link: { source_domain_authority: number }) => link.source_domain_authority >= minDA43 );4445 return NextResponse.json({46 target,47 total_links: data.total_links,48 results: links.map((link: {49 source_url: string;50 target_url: string;51 anchor_text: string;52 source_domain_authority: number;53 source_page_authority: number;54 flags: number;55 }) => ({56 source_url: link.source_url,57 target_url: link.target_url,58 anchor_text: link.anchor_text ?? '',59 source_domain_authority: link.source_domain_authority,60 source_page_authority: link.source_page_authority,61 is_nofollow: Boolean(link.flags & 32),62 })),63 });64}Pro tip: Moz's link flags are bitfields — bit 5 (value 32) indicates nofollow, bit 2 (value 4) indicates the link was deleted. Use bitwise AND to check individual link attributes.
Expected result: The links API route returns a list of backlinks for any target URL, each with source domain authority, page authority, anchor text, and nofollow status. The dashboard displays these in a sortable table.
Common use cases
SEO Authority Audit Dashboard
Build an internal dashboard where your team can paste any URL and instantly see its Domain Authority, Page Authority, Spam Score, and link counts. Useful for pre-qualifying guest post targets, evaluating acquisition targets, and benchmarking against competitors.
Create an SEO audit dashboard at /seo-audit. Add a URL input field where users can paste any website URL. On submit, call /api/moz/url-metrics with the URL to fetch Domain Authority, Page Authority, Spam Score, and number of linking root domains from the Moz API. Display the results as metric cards with color coding (green for DA 50+, yellow for 30-50, red for under 30). Cache results in Supabase for 24 hours to avoid redundant API calls.
Copy this prompt to try it in Bolt.new
Bulk URL Analyzer for Link Prospecting
Analyze a list of URLs in bulk to quickly score prospects for link building outreach. Paste a list of domains, get authority scores for all of them, and sort by DA to prioritize high-authority targets.
Build a bulk SEO analyzer page. Accept up to 20 URLs pasted in a textarea (one per line). On submit, call the Moz URL Metrics API for each URL via my API route and display results in a sortable table with columns: URL, Domain Authority, Page Authority, Spam Score, and Linking Root Domains. Sort by Domain Authority descending by default. Show a loading skeleton while fetching. Export to CSV button using client-side CSV generation.
Copy this prompt to try it in Bolt.new
Competitor Backlink Research Tool
Analyze the backlink profile of any competitor URL using the Moz Links API. See which high-authority domains link to them, what anchor text they use, and identify link building opportunities to replicate.
Create a competitor backlink analysis page. Accept a target URL. Call /api/moz/links with the URL to fetch the top 25 backlinks from Moz's Links API. Display each backlink as a card showing: source domain, Domain Authority of the source, anchor text, and whether the link is follow or nofollow. Show total backlink count at the top. Add a filter to show only links from domains with DA 30 or higher.
Copy this prompt to try it in Bolt.new
Troubleshooting
Moz API returns 401 Unauthorized
Cause: The Basic Auth header is incorrect — either the Access ID or Secret Key is wrong, or they've been transposed (Secret Key used as username, Access ID as password).
Solution: Verify MOZ_ACCESS_ID and MOZ_SECRET_KEY in your .env match exactly what's shown in your Moz account API settings. The Access ID is the username and the Secret Key is the password: Buffer.from('AccessID:SecretKey').toString('base64'). Check there are no leading/trailing spaces in the credential values.
1// Correct Basic Auth construction for Moz2const MOZ_AUTH = Buffer.from(3 `${process.env.MOZ_ACCESS_ID}:${process.env.MOZ_SECRET_KEY}`4).toString('base64');5// Header: 'Authorization': `Basic ${MOZ_AUTH}`Moz API returns 429 Too Many Requests or row limit exceeded error
Cause: Your account's monthly API row budget has been exhausted, or you're making too many requests too quickly. Moz's free tier has a low monthly row limit.
Solution: Implement caching in Supabase — store URL metrics results with a cached_at timestamp and only call the Moz API again if the cache is older than 24 hours. For bulk analysis, batch URLs into groups of 10-20 and add a 1-second delay between batches. Consider upgrading to a Moz paid plan for production tools with higher volume needs.
1// Add rate limiting delay between batch requests2for (let i = 0; i < batches.length; i++) {3 const results = await fetchBatch(batches[i]);4 allResults.push(...results);5 if (i < batches.length - 1) {6 await new Promise(resolve => setTimeout(resolve, 1000)); // 1s delay7 }8}Moz returns DA of 0 or null for a known popular website
Cause: The URL format is incorrect — Moz requires the full URL with protocol (https://). Domain-only strings without a protocol may not match Moz's index.
Solution: Normalize all URLs before sending to the Moz API: ensure they include the https:// protocol and remove trailing slashes. Use the normalizeUrl() helper function to standardize inputs before sending to Moz.
1function normalizeUrl(url: string): string {2 const trimmed = url.trim();3 if (!trimmed.startsWith('http')) return `https://${trimmed}`;4 return trimmed.replace(/\/$/, '');5}Best practices
- Cache Moz API results in Supabase with a 24-hour TTL to reduce row consumption and improve response times for repeated URL lookups
- Always normalize URLs before sending to Moz — include the https:// protocol and remove trailing slashes for consistent results
- Never expose MOZ_ACCESS_ID or MOZ_SECRET_KEY in client-side code — all Moz API calls must go through server-side API routes where they access process.env variables
- Batch multiple URL requests in a single Moz API call (up to 50 URLs per request in v2) rather than making individual calls to save your monthly row budget
- Add context to DA and PA scores for non-technical users — a DA of 45 means little without labels like 'Moderate Authority' or comparisons to known reference points
- Monitor your monthly row usage in the Moz account dashboard and set up alerts before you hit the limit to avoid unexpected API failures in production tools
- Use the Links API with source_scope: 'root_domain' to get unique linking domains rather than individual pages — this gives a cleaner competitive overview
Alternatives
Ahrefs has a larger backlink index and more comprehensive keyword data — the better choice for professional SEO agencies that need maximum data coverage despite higher API costs.
SEMrush covers the full SEO plus PPC plus content marketing spectrum in one platform — better for teams that need keyword research, position tracking, and paid search data beyond link metrics.
Serpstat is a more affordable alternative with keyword research and SERP analysis capabilities — a better fit for budget-conscious projects that don't specifically need Moz's Domain Authority metric.
Screaming Frog is a desktop crawler for technical SEO audits — complementary to Moz rather than a replacement, as it handles on-page issues while Moz covers link authority.
Frequently asked questions
How do I get a Moz API access token?
Log into your Moz account at moz.com and navigate to moz.com/products/mozscape/access (or your account's API section). You'll find your Access ID and Secret Key listed there. Free Moz accounts include a limited number of monthly API rows. Create a paid Moz subscription for higher monthly limits needed by production SEO tools.
Can I call the Moz API from Bolt's WebContainer preview?
Yes. Moz's API is a standard HTTPS REST API with no special connection requirements — all calls are outbound from your API route to Moz's servers. Since Bolt's WebContainer supports standard outbound HTTPS requests, you can develop and test the full Moz integration in the preview without deploying. Moz has no webhooks or incoming connection requirements.
What is Moz Domain Authority and how does it differ from Page Authority?
Domain Authority (DA) is a score from 1 to 100 predicting how well a website's entire domain will rank in search engines, based on its overall link profile strength. Page Authority (PA) is the same scale but for a specific individual page rather than the whole domain. A site's homepage typically has a lower PA than its DA, while a popular blog post on a high-DA site might have a PA close to or exceeding the domain's DA.
How many URLs can I analyze per month with Moz's free tier?
Moz's free tier includes a limited number of API rows per month — each URL in a URL Metrics request consumes one row, and each link returned from the Links API also consumes rows. The exact free limit is shown in your Moz account dashboard. For development and testing, the free tier is sufficient. Production tools with high query volume need a Moz paid API subscription.
Is Moz's npm package available for Bolt.new?
Moz does not have an official Node.js SDK npm package — the API uses direct HTTP calls with Basic Auth. This is actually simpler: use the built-in fetch() API in your Next.js API routes with the Authorization: Basic header. No npm install needed beyond what Bolt already provides.
Talk to an Expert
Our team has built 600+ apps. Get personalized help with your project.
Book a free consultation