---
title: "Authentication: Public Resources and Internet Status | Hamlet's Friends"
description: "Hamlet's Friends public resources need no API key or login. Only the live internet-status endpoint is gated, by the finca's network or a guest password."
url: "https://hamletsfriends.com/authentication/"
locale: "en"
lastmod: "2026-10-15"
alternates:
  en: "https://hamletsfriends.com/authentication/"
  x-default: "https://hamletsfriends.com/authentication/"
site_index: "https://hamletsfriends.com/llms.txt"
---
# Authentication

Almost everything on this host is public. One endpoint is not.

## Public resources need no credentials

Every page, Markdown twin and text file on hamletsfriends.com answers a plain GET with no API key, token, cookie or login. That covers /llms.txt, /llms-full.txt, /pricing.md, /facts.md, /sitemap.xml, /openapi.json and the booking link on /book-now/. There are no API keys to apply for.

curl

```bash
curl -s https://hamletsfriends.com/facts.md
```

JavaScript

```javascript
const response = await fetch('https://hamletsfriends.com/facts.md');
const facts = await response.text();
```

## Internet status: the finca's network or a password

GET /api/internet-status reports whether the internet and the Wi-Fi at the finca work. A request from the finca's own network passes without a password, because the endpoint compares the caller's IP address with the finca's internet connections. A request from anywhere else must send the guest password in the x-status-password header. The password is the guest Wi-Fi password.

Without either, the endpoint answers 401 with the body {"error":"unauthorized"}. Send the password in the header only. A pw query parameter is ignored, so the password stays out of logs and browser history.

curl

```bash
curl -s https://hamletsfriends.com/api/internet-status \
  -H "x-status-password: $HF_STATUS_PASSWORD"
```

JavaScript

```javascript
const response = await fetch('https://hamletsfriends.com/api/internet-status', {
  headers: { 'x-status-password': process.env.HF_STATUS_PASSWORD },
});
if (response.status === 401) throw new Error('Not on the finca network, and no valid password');
const status = await response.json();
```

Response

```json
{
  "error": "unauthorized"
}
```

## Nothing open to third parties accepts writes

No endpoint open to third parties accepts writes. Two endpoints take a POST, and they serve the site's own pages and a scheduled job, and refuse other callers. Bookings happen in the Sirvoy booking engine that /book-now/ loads, and a POST, PUT or DELETE to a page or file returns 405. See [every status code](https://hamletsfriends.com/errors/) and [rate limits](https://hamletsfriends.com/rate-limits/).