Mylead

Record one report on a sale: the first creates it, the next ones move its status and carry what changed.

404 to a wrong or missing key, or a call MyLead did not sign, as to a page that does not exist: nothing here should tell a stranger the address is real. Both compared in constant time.

The signature is over the url as MyLead called it, so it is rebuilt from the site's own address rather than the request's: Cloudflare and Caddy stand between, and the api sees neither MyLead's scheme nor its host.