LocalPatron

3 years ago, my wife Karla and I opened La Casa de Burger in Torrevieja, Spain.

Between 12-hour shifts in front of the grill, I was coding LocalPatron—an Edge-native SaaS (Next.js/Cloudflare) to automate Google Business Profile SEO for local SMBs and agencies.

While massive agencies and funded startups take months or fail to get direct production access to Google’s GBP API, I got fully approved on the allowlist in 35 days on my first try.

But we almost lost everything on week two.

Here is the real story of the showdown with Google's human auditor:

The Trap: Google’s auditor blocked our API quota at 0. His ultimatum was brutal: either provide a SaaS website older than 60 days, OR replace my restaurant’s website URL with the new SaaS URL.

The Refusal: Changing my restaurant’s live URL on Google Business Profile would trigger automated spam bots, risking immediate suspension of my actual business. I refused to sacrifice my restaurant for an API ticket. I told the auditor: No.

The "Footer Hack": Instead of obeying the template response, I went into the GCP console, renamed the app "LocalPatron by La Casa de Burger", and live-edited the HTML footer of my restaurant’s website to add: "Powered by localpatron.app".

I sent the video recording showing the live site, holding the mouse cursor static over the address bar for 3 seconds to trigger the Windows tooltip (showing the full untruncated client_id parameter without breaking the video flow).

The Result: The Google auditor was so stunned by the real-world proof that he manually bypassed the 60-day rule, updated the URL himself, and granted us 250,000 requests/day read quotas and 300 req/min update access.

Building from the kitchen floor gives you an unfair advantage. You don't build software to impress investors; you build it to survive.

If you're currently stuck in Google API audit hell or preparing your OAuth consent screen, drop a comment below and I'll send you the unlisted link directly!

Hey IH,

Fabrice here. By day, I run a local burger shop in Spain (La Casa de Burger). By night, I code.

If you’ve ever tried to build a tool around the Google Business Profile (GBP) API, you know the absolute nightmare that is the compliance audit. It's notorious for multi-month delays, endless email loops, and unexpected rejections over technical details.

35 days ago, I submitted my side project LocalPatron for production access, fully expecting a long battle.

I recently got the approval email. First try, 35 days total (submitted July 16, approved August 20).

I wanted to share how a solo dev managed to clear it cleanly without a legal or compliance team:

• The Scrappy Verification Hack: Google’s auditor required strict proof of real-world SMB usage and domain ownership under specific policy guidelines. Instead of writing long documentation, I live-edited the footer of my own restaurant’s live website on the spot, injecting the exact technical disclosures requested. The auditor saw a real brick-and-mortar business running the software in real-time, which cleared all doubts instantly.

• Building on a $0 Edge Stack: Keeping infrastructure simple helped immensely. I built using Next.js, Cloudflare Workers and Supabase. When the auditor tested performance, the light stack naturally delivered a blazing sub-2s LCP and 0ms TBT on PageSpeed Insights, showing the app was stable and production-ready.

• Building from Real Need: I didn't build this from a theoretical spec—I built it to solve my own daily headaches managing my restaurant's local presence. That ground-level focus made passing the practical compliance checks much easier.

I'm currently preparing our official launches, but I wanted to drop this experience here first in case it helps anyone else navigating API audits.

If you’re currently stuck in Google's compliance loop, tweaking Cloudflare Workers/Supabase, or balancing a physical business with coding, drop a comment below—happy to share any details that might help!