Authentication

Every request carries a key in the Authorization header:

Authorization: Bearer sl_live_…

curl https://app.simplifylocal.app/api/businesses/{slug} \
  -H "Authorization: Bearer sl_live_…"

Tenant keys

A tenant key starts with sl_live_ and is bound to one business. It reads that business only: a request for any other {slug} is refused with 403 cross_tenant.

Keys are stored hashed. The plaintext is shown once when the key is issued and cannot be recovered afterwards, so store it in your secret manager at that point.

A key has no expiry. It stops working the moment it is revoked.

Getting a key

Email support@simplifylocal.app from an admin account on the business and ask for a Publish API key. We issue it and send it to you once.

Rotating a key

Ask support for a new key, switch your integration to it, then ask for the old one to be revoked. Both keys work until the old one is revoked, so there is no gap.

Treat a key like a password. If one leaks, ask for it to be revoked immediately; a revoked key answers 401 invalid_token on its next use.

Test keys

There is no separate test key. Every key reads live, published data for its business.

Responses to an authentication problem

Status	`error`	When
`401`	`missing_authorization`	No `Authorization` header, or it does not start with `Bearer` .
`401`	`invalid_token`	The key has an unrecognised prefix, does not exist, or has been revoked.
`403`	`cross_tenant`	The key is valid but `{slug}` belongs to a different business.
`404`	`business_not_found`	No business has that `{slug}`. Answered before the key is checked, so a bad key on an unknown slug still gets `404`.
`410`	`business_closed`	The business’s account has been closed. Only the business’s own key sees this; any other caller gets `404 business_not_found`. Stop serving the pages.
`500`	`lookup_failed`	A temporary problem on our side while checking the slug or the key. Retry.

The checks run in this order and the first match wins: temporary failure (500) → closed business (410, or 404 to anyone but its own key) → unknown slug (404) → missing or invalid key (401) → another business’s key (403).

Error bodies are described in Errors.