byLegit Business API

1. Get a key

In the Business console, open your site page, go to the API tab and create a key. It starts with blg_ and is shown only once. A key belongs to a single site and can be revoked at any time.

curl https://bylegit.com/api/public/v1/ping   -H "Authorization: Bearer blg_your_key"

{
  "status": "ok",
  "domain": "example.com",
  "verify_url_configured": true
}

2. Push mode — you tell us about a signup

When a user signs up (or during a one-off import), send their email address. byLegit always answers the same thing: the request was accepted. Nothing is revealed about byLegit accounts.

curl -X POST https://bylegit.com/api/public/v1/customers   -H "Authorization: Bearer blg_your_key" \
  -H "Content-Type: application/json" \
  -d '{"email":"person@example.com"}'

{ "status": "accepted" }

The address is never stored in clear text: we keep only a cryptographic fingerprint scoped to your site.

2b. Describe your app

People who sign in to your site with byLegit see a profile of your app in their privacy settings. Publish your description, exactly how the shared data is used, how long you keep it, and your legal links: it is a transparency signal that reassures your users. A GET on the same URL returns the current profile.

curl -X POST https://bylegit.com/api/public/v1/app-profile \
  -H "Authorization: Bearer blg_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "app_name": "Example Hosting",
    "tagline": "Minecraft hosting, free tier included",
    "description": "We host game servers for 40k players.",
    "data_usage": "Your email creates or matches your account. Your public name and photo appear on your dashboard. Nothing is sold or used for advertising.",
    "retention": "Kept while your account exists, deleted 30 days after closure.",
    "publisher": "Example SAS",
    "support_email": "privacy@example.com",
    "privacy_url": "https://example.com/privacy",
    "terms_url": "https://example.com/terms",
    "logo_url": "https://example.com/logo.png"
  }'

{ "status": "saved", "domain": "example.com" }

3. Lookup mode — we ask you yes or no

Set an HTTPS verification endpoint on your key. When someone writes a review, byLegit sends a signed request to it and expects a simple boolean.

POST https://example.com/bylegit/verify
Content-Type: application/json
x-bylegit-signature: <HMAC-SHA256(body, your_api_key)>

{ "email": "person@example.com" }

{ "registered": true }

Always verify the signature before answering: it is an HMAC-SHA256 of the raw request body, keyed with your API key. Answer within 6 seconds, and return nothing beyond registered.

// Node example
import { createHmac, timingSafeEqual } from "node:crypto";

const raw = await readRawBody(req);
const expected = createHmac("sha256", process.env.BYLEGIT_API_KEY).update(raw).digest("hex");
const given = req.headers["x-bylegit-signature"] ?? "";
if (given.length !== expected.length ||
    !timingSafeEqual(Buffer.from(given), Buffer.from(expected))) {
  return res.status(401).json({ error: "bad signature" });
}
const { email } = JSON.parse(raw);
res.json({ registered: await userExists(email) });

4. The verified customer badge

When a signal exists, the reviewer is asked explicitly before publishing. If they accept, the review carries the “Verified customer” badge. If they decline, the review is published as usual, without a badge. Anyone can also switch these verifications off, or delete the resulting data, from their privacy settings.

5. Rules and limits

• A key grants access to a single site, never to reviews or profiles.
• The API never reveals whether a byLegit account exists, nor any personal data.
• Only send addresses of your own users, with a valid legal basis.
• Revoke any compromised key from the console: revocation is immediate.