Can I use a AGPL/GPL package and software for closed-source backend API?

Question

I'm creating an API for a website. An interesting Node.js package I would need is licensed under the AGPL-3. that package is a binding library that speaks to a GPL-2 licensed software (compiled binary).

I searched for quite some time and I wasn't confident about my understanding of the AGPL and GPL license with how I would need to use them - too many different interpretation of both licenses it seem.

Both the software and the package would be on the same machine. The client (website) sends a request to the server. The server uses the AGPL library to get some results, might change/adjust/add or remove values and then send the data to the website.

I've read, for both license that I may, or may not need to disclose the code. I read both licenses but I get lost and confused very rapidly. I put my understanding further down below.

Rephrasing everything to be safe:

• Website calls API
• API includes multiple things/services and only a subset of resources/a single service need this package (and therefore this software)
• API uses package to determine some values.
• • Package calling the software is AGPL 3.
• • Software is GPL 2
• Data is returned to the API
• The API might make some corrections
• Data is returned to the website

Some statements - to be extra clear:

• I will not make modification to the Node.js package or the software it's calling
• I will allow free access to the website (rate limited)
• I will not allow access to the API to the public (the website still need to call the API)
• I would maybe charge a small amount to access some part of the website, eventually
• I would like to maybe allow access to the API (rate limited/free tier and paid tier) in the future.
• The API is vast and cover a lot of various services. The package above would only by a single service.
• The API (the fastify server) is a single source code right now

Questions - If my understanding is wrong:

1. a)Which license in this requires me to open-source the REST API source code?
2. b)What would change if the package was LGPL-3.0?
3. Do I need to open-source the website?
4. Not to sound harsh, but if I do need to open-source the REST API, what can I do to either not do it (except not using the package and/or software) or limit what will be open-source?
5. Any other considerations, notes or tips?

(This was longer than intended, sorry. Editors feel free to clean this up if needed - thank you)

Answer 1

1. a)Which license in this requires me to open-source the REST API source code?

The AGPL license on the third-party package requires you to make the entire API software subject to the AGPL license.

2. b)What would change if the package was LGPL-3.0?

Then the API software as a whole would not be required to be under an open-source license. Your only requirement then would be that if you distribute the API software itself, then the recipients of the software must be able (and allowed) to replace the LGPL parts.

3. Do I need to open-source the website?

No, you do not need to make the website open-source. Only the API software.

4. Not to sound harsh, but if I do need to open-source the REST API, what can I do to either not do it (except not using the package and/or software) or limit what will be open-source?

To limit what must be under the AGPL license, you could try to make 2 REST APIs. One open-source containing the functionality where the AGPL package is involved and a separate one that does not involve the AGPL package. For this to work, you will have to maintain a very clear separation between the two APIs, all the way from source code repository to deployment.