Two footer entries are not ordinary links. Cookie preferences opens the consent manager rather than navigating. The support address is a mailto: — a findable address, not only a form, because a contact form alone does not satisfy someone who wants somewhere to write.

The footer base carries three fixed items: the line Every listing here comes from the employer or a government feed, the payment provider's mark (who handles the money), and a link to the parent product.

/api and /docs are deliberately different pages for different moments. /api is the pitch and the price list — “can this do the thing, and what does it cost”. /docs is the reference — “how exactly does it work”. They cross-link and do not duplicate; the full parameter reference lives here, not there.

/admin/* is the operator console — ads, donations, keys, messages, providers, submissions — behind its own authentication and deliberately plain. It is listed here for completeness, not as something to use. Its nav entry is coloured differently from every other nav item precisely so it cannot be reached by accident or mistaken for a customer surface.

The /api/* routes are the website's own JSON endpoints, not part of the public API, and they exist so that the browser never talks to the API host directly — the API base URL stays internal and the forms inherit the site's own edge protections. They are excluded from crawling in robots.txt and they are explicitly allowlisted at the edge, because a bot challenge in front of an XHR is a challenge no XHR can solve. That was once true of /api/checkout, and the consequence was that the buy button could not work.

Turnstile

A privacy-preserving bot check. It runs in the browser; the token is verified server-side before the submission is accepted.

The opt-out code

Six digits, cryptographically random, stored only as a domain-salted hash. Five attempts, thirty-minute expiry, two-minute resend window.

Failure behaviour

Every form reports the API's own message rather than a generic one, and none of them clears what you typed on failure.

The dashboard is rendered per request rather than cached, because it is per customer. Everything on it is described control by control in the dashboard tour.