ContextKit for developers

ContextKit is a privacy oracle for someone's location. Your app doesn't read where a person is — it asks a question and gets the smallest true answer.

Is the user inside this delivery zone?     → inside
Which of their places are they at?         → "Home"
Tell me when they arrive at the office     → webhook, on arrival

The person's coordinates never appear in any of those responses. That's not a limitation to work around; it's the reason people connect their location to your app at all.

Why you want the question API

The obvious design would hand you a latitude and longitude and let you work it out. Almost every app that asks for location doesn't actually want one:

Every one of those is a question. Asking it directly means you never store someone's coordinates, never have to secure them, and never have to explain a breach of them. It also means users say yes more often, because the consent dialog says "can ask whether you're home" rather than "can see your location."

The two tiers

Standard scopes answer questions. They never return a position, and users grant them with a single tick.

Sensitive scopes return exact coordinates. They still exist — some products genuinely need a live map — but they cost you: a warning at connect time, an expiry the user picks (30 days by default), and a developer application that must justify each one in at least 100 characters. Ask for them only when an answer genuinely won't do.

Most apps never need the sensitive tier. Before requesting one, check Derived history — a journalling or photo app usually wants place labels and time windows, not coordinates.

How access works

1. You register an app and declare the scopes it may request.
2. A user connects your app and approves scopes individually — they can grant fewer than you asked for.
3. You receive a cka_ token, shown exactly once.
4. Every call you make, and every webhook we send you, is written to an access log the user reads.

That last point is worth sitting with. Users can see the questions you asked, in plain language, including the zones you asked about. Design your integration so those lines look reasonable — because they'll be read.

Access ends the moment a user disconnects you, or their grant expires. Both kill standing webhook rules too, not just new reads.

Where to go next