Helipaddy sites vs Mercedes-Benz

Helipaddy's Partner API returns nearby helicopter, EVTOL, and drone landing sites — hotels, aerodromes, pubs, and B&Bs with helipads — as JSON, gated to a per-partner category allow-list. A live GET and OPTIONS preflight against its real API host, helipaddy.com/wp-json/hp-partner/v1/sites, both echoed access-control-allow-origin back with the request Origin, resolving the stored "unknown" cors to "yes"; the GET returned a "hp_partner_api_invalid_key" 401 error, reconfirming auth "API Key" over HTTPS. Partner tokens are issued manually via WhatsApp/email under a negotiated agreement with no public self-serve tier — paid.

Mercedes-Benz's connected-vehicle API platform exposes telematics data, remote vehicle commands, a car configurator, and dealer-locator lookups behind an OAuth2 client-credentials/authorization-code flow — its own docs describe exchanging a Base64-encoded Client ID/Secret for a bearer token, correcting the stored auth from "API Key" to "OAuth". A live unauthenticated GET against the real api.mercedes-benz.com gateway returned no Access-Control-Allow-Origin header on any endpoint tested, reconfirming cors "no" — consistent with Mercedes-Benz's own documentation that the API doesn't support direct browser calls; https was reconfirmed. The platform offers a free sandbox/BYOCAR tier for testing against simulated and real vehicles, plus paid production tiers per API product — freemium.