Authentication

Public resources need no credentials

Every page, Markdown twin and text file on hamletsfriends.com answers a plain GET with no API key, token, cookie or login. That covers /llms.txt, /llms-full.txt, /pricing.md, /facts.md, /sitemap.xml, /openapi.json and the booking link on /book-now/. There are no API keys to apply for.

curl -s https://hamletsfriends.com/facts.md

const response = await fetch('https://hamletsfriends.com/facts.md');
const facts = await response.text();

Internet status: the finca's network or a password

GET /api/internet-status reports whether the internet and the Wi-Fi at the finca work. A request from the finca's own network passes without a password, because the endpoint compares the caller's IP address with the finca's internet connections. A request from anywhere else must send the guest password in the x-status-password header. The password is the guest Wi-Fi password.

Without either, the endpoint answers 401 with the body {"error":"unauthorized"}. Send the password in the header only. A pw query parameter is ignored, so the password stays out of logs and browser history.

curl -s https://hamletsfriends.com/api/internet-status \
  -H "x-status-password: $HF_STATUS_PASSWORD"

const response = await fetch('https://hamletsfriends.com/api/internet-status', {
  headers: { 'x-status-password': process.env.HF_STATUS_PASSWORD },
});
if (response.status === 401) throw new Error('Not on the finca network, and no valid password');
const status = await response.json();

{
  "error": "unauthorized"
}

Nothing open to third parties accepts writes

No endpoint open to third parties accepts writes. Two endpoints take a POST, and they serve the site's own pages and a scheduled job, and refuse other callers. Bookings happen in the Sirvoy booking engine that /book-now/ loads, and a POST, PUT or DELETE to a page or file returns 405. See every status code and rate limits.