The APIs
The APIs, in depth
Every outside party this product calls — including the ones wired but not configured, and the free public endpoints called with no account at all.
| Provider | What it unlocks | Environment |
|---|---|---|
| DataForSEO | Search, SEO, reviews and backlinks. DataForSEO supplies the search data for paid reports and the beta weekly search check; its AI lanes stay parked, and the free read never calls it. | DATAFORSEO_LOGIN DATAFORSEO_PASSWORD |
| ScrapeCreators | Social profiles and posts across seven platforms, the brand's own video transcripts, organic mentions, and the ad-transparency archives. | SCRAPECREATORS_API_KEY |
| Firecrawl | The site capture — and with it logos, colors, typography and screenshots. | FIRECRAWL_API_KEY |
| Context.dev | Six optional units, all off by default behind the same two gates: the report's design-system section (rendered style guide), a second opinion on five finished report claims, the quality reviewer's cross-source receipts, industry + NAICS/SIC seeding only where no human or domain-verified source exists, a one-credit competitor list beside DataForSEO's, and two rescues — interview prefill chips before a pull, and page recovery when a site blocks the crawler. None can alter a collector's output, outrank a human answer, or change the pull outcome. | CONTEXT_DEV_API_KEY |
| OpenAI | The fallback door for four of the five model calls — the voice read, the confirm-step adjudicator, the quality review and the confirm-step suggestions — on a deployment that holds no Gateway key. The fifth, the AI-visibility grid, needs the Gateway and is parked in the alpha. | OPENAI_API_KEY |
| SerpApi | Four things nothing else in the stack can do, all inside the reputation check: Google's AI Mode answer for your city, whether your category's sites are buying ads, who talks about you on YouTube, and your search-interest curve. DEEPEST SETTING ONLY, AND CITY-GATED: your Google Maps listing's own verbatim reviews (with the owner's replies), and — for the home-services/legal/healthcare brands Google's Local Services program actually covers — who holds the Google Guaranteed box in your city. Without it the report still maps your category's shelves — that sweep runs on DataForSEO — but loses the AI-answer surface and the panels above. | SERPAPI_API_KEY |
| Vercel AI Gateway | The door every model call goes through when AI_GATEWAY_API_KEY is set — the voice read, the confirm-step adjudicator, the quality review, the confirm-step suggestions and the AI-visibility grid. Unset it and the first four fall back to calling OpenAI directly, unchanged; the grid needs the Gateway and is parked in the alpha. | AI_GATEWAY_API_KEY |
| Resend | Delivery of the weekly change summary email, only to an account that has turned it on and only to that account's verified address. No report reads it, and it is never called on signup or when you open a report. | RESEND_API_KEY |
| Stripe | Card checkout for credit packs and the signed payment notification that grants the credits. Off until the merchant account is confirmed; no report, balance read or provider call goes through it. | STRIPE_SECRET_KEY STRIPE_WEBHOOK_SECRET |
| Supabase | Accounts, saved reports and the credit ledger. Required only for the hosted app. | SUPABASE_URL SUPABASE_ANON_KEY SUPABASE_PUBLISHABLE_KEY SUPABASE_SERVICE_ROLE_KEY NEXT_PUBLIC_SUPABASE_URL NEXT_PUBLIC_SUPABASE_ANON_KEY |
| Vercel | Hosting and the cron that drains the pull queue. Required only for the hosted app. | CRON_SECRET VERCEL VERCEL_ENV VERCEL_URL |
| Serper | Set it and the search leg routes here instead of DataForSEO. | SERPER_API_KEY |
| Brave Search | Web search for the local collection lane's search-context collector. | BRAVE_SEARCH_API_KEY |
| Apify | An alternate route to Instagram and TikTok profiles. | APIFY_TOKEN |
| YouTube Data API | YouTube straight from Google on a free daily quota, instead of through ScrapeCreators. | YOUTUBE_API_KEY |
| Meta ad library (Graph API) | Real Facebook and Instagram ad rows from Meta's own archive, free. | META_ADLIB_TOKEN |
| Brandfetch | A logo fallback for sites whose own markup carries none. | BRANDFETCH_API_KEY |
| Google Places API | Nothing on the hosted report — it is used only by the local brand-md collection lane. | GOOGLE_PLACES_API_KEY |
| Public web sources (no account, no key) | Everything below runs with no key at all, and always has. | No key. These endpoints are public. |
| Google PageSpeed Insights | Site Health — the one dimension of the website leg nothing else in the stack measures: real Lighthouse scores and Core Web Vitals for your own homepage. | PAGESPEED_API_KEY |
| USPTO TSDR (Trademark Status & Document Retrieval) | Brand protection — real trademark status (live/dead/pending) for a KNOWN serial or registration number. This pipeline has no name -> number lookup step yet, so this call is real but usually idle; the deterministic tmsearch.uspto.gov search link stays the default path for a bare brand name. | USPTO_TSDR_API_KEY |
A supplier we hold a key for but never call still appears
"Wired but never used" is a fact a self-hoster needs before going and buying a key, so those rows are listed with an empty endpoint list and the reason, rather than omitted.
Backlinks
Who links to you, how many domains do it, how healthy that profile is, and how it compares against the competitors the run found.
DataForSEO
Real Google result pages, keyword volume and difficulty, the web's link graph, Google Business listings and Trustpilot, and how often AI assistants mention you.