Kroger vs Untappd

Kroger's public API exposes product search, pricing, and store-locator data across its US supermarket banners for registered developer applications using an OAuth client-credentials token. A live GET against the real gateway, api.kroger.com, returned a genuine 401 'access_token is missing' JSON error while carrying an echoed Access-Control-Allow-Origin header, resolving cors unknown -> yes and reconfirming API Key auth in the same probe.

Untappd's public API exposes its social beer check-in platform — beer and brewery details, user check-ins, and venue activity — for applications registered through its OAuth developer program, free and rate-limited to 100 calls/hour per key. A live GET against the real gateway, api.untappd.com, returned a genuine 'missing client_secret/client_id' JSON error while carrying Access-Control-Allow-Origin: *, resolving cors unknown -> yes and reconfirming OAuth auth in the same probe.