Verifiable Data > Claimed Data: What i'm Trying to do with Ori's List

Most of the data we act on is claimed data. Someone tells you a number, shows you a chart, or hands you a PNG, and you decide whether to believe them. Verifiable data is different. You can trace it back to the system that produced it, and the person showing it to you couldn't have changed it along the way. As developers, we already know this. We don't trust a screenshot of a passing test suite. We trust the CI run. We don't trust "it works on my machine." We trust a reproducible build. Proof is something you can check, not something someone describes to you. I've done SEO since 2007, and the SEO agency market runs almost entirely on claimed data. That's the gap I'm trying to close with Ori's List.

The problem, in engineering terms

When you hire an SEO agency, the pitch is usually a case study: a traffic chart, a big percentage, a client logo. Every one of those is a claim. The chart went through the seller's hands before it reached you, and nothing ties it back to its source. Nobody has to be lying for this to be a problem. The format makes honest agencies and dishonest ones look identical. There's no signal in it.

The question I actually want answered is simple: can this agency rank its own website? Their own site is the one project they fully control. If they can't get organic traffic for themselves, why would you trust them to get it for you? Google already knows the answer. It lives in Google Search Console. The trick is getting it out without anyone touching it on the way.

The mechanism: read-only OAuth instead of uploads

Ori's List doesn't accept screenshots, reports, or self-reported numbers. An agency connects its own Search Console through Google OAuth with a single scope: https://www.googleapis.com/auth/webmasters.readonly

From there, a few design rules do most of the work:

• The data comes from Google, not the agency. The directory pulls clicks for the agency's own root domain directly from the API. There's no form field where a number could be typed in.
• It's re-checked every week. Verification is a subscription to reality, not a one-time badge. If access is revoked or the property goes missing two checks in a row, the verified mark and the performance data come down.
• The numbers can't be bought. Free and paid listings publish exactly the same data. Paying gets a check mark, a link, and placement. It never gets a better number.
• Data is allowed to go down. If an agency's traffic declines, the listing says Declining. It keeps its listing and its verification. That last rule is the one I care about most. A system that can only show good news isn't proof. It's a trophy case. Verified doesn't mean good. It means real.

Minimum access, minimum storage

If you're asking businesses to connect a Google account, the privacy design has to be as strict as the verification. The rules I stuck to:

• Read-only scope, nothing broader.
• Own domain only. Client properties are rejected.
• Aggregates only. Individual search queries are never published.
• Disconnecting wipes the stored data.

Asking for less access also makes it easier for an agency to say yes. That's the practical upside of scoping tightly.

The pattern is bigger than SEO

Swap the nouns and this applies to a lot of software:

• Freelancer platforms showing earnings pulled from a payment API instead of self-reported.
• Growth claims backed by a read-only analytics connection instead of a slide.
• Uptime pages built from independent probes instead of a status page someone edits.

Most major platforms already offer read-only OAuth scopes. The infrastructure for verifiable data exists. We just haven't made "show me the source" a normal thing to ask for, or a normal thing to build.

What I'd ask other builders

If your product displays a number that someone could be tempted to inflate, ask yourself:

• Can this come straight from the source system instead of from the user?
• Can the person displaying it edit it? If so, why?
• Does it update, or does it freeze at its best moment?
• Can it go down?

If the answers are yes, no, it updates, and yes, you're publishing verifiable data. Otherwise it's a claim, however nicely it's formatted.

I'd love feedback on the approach, especially on the privacy side of the OAuth flow. And if you run an SEO agency and think you can rank yourself, you know where to prove it.