# Zapier: 1 point Door Gap
- Site: zapier.com
- Scanned: 2026-09-03
- Scan type: Deep scan
- Business type: b2b_saas
- Report: https://www.seconddoor.io/r/zapier-8dggw4
- Scanner version: 10
Zapier lets a human sign up for free in two clicks, but a developer or agent wanting programmatic API access hits a sales-only wall on the Workflow API page.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 73/100 |
| Agents | 72/100 |
| Composite | 73/100 |
| Door Gap | 1 points |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The agent got through 12 of 17 requests, but could not find a contact route for machines. It came up empty on 4 other checks too.
- ok      reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- ok      find out what pages exist
- missing find a contact route for machines
- ok      find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- ok      read the homepage as data rather than as a page
- missing find a machine readable API spec
- ok      read the developer documentation
- ok      read the prices without running JavaScript
- ok      find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
- missing Check developer platform API key signup path
- ok      Check MCP manifest content for auth/key issuance details
## What a visitor meets
1. **Landing page** (friction). Headline "Smarter workflows. Smaller bills." explains AI automation across apps. Takes a moment to grasp this is an AI/app integration platform. A survey popup covers part of the page immediately, adding friction before reading.
2. **Signup form** (smooth). Reached in 2 clicks from homepage. Form asks work email, first name, last name, or Google SSO. No password field shown yet, no credit card required. Mentions 14-day trial of premium features, implying free plan afterward. Fields are simple and few, no visible required-field friction beyond the basics.
3. **Pricing page** (smooth). Prices published without gating: Free, Professional $19.99, Team $69, Enterprise by quote. A task-volume slider adjusts tiers. A sales chat popup appears unsolicited, another interruption. Prices are legible without login, good for self-serve evaluation.
4. **Developer platform / API page** (friction). The Workflow API page for powering a product or AI agent leads only to "Contact sales" as its call to action, no self-serve API key or docs link on this hero. A developer wanting programmatic access without a sales call hits a wall here, docs exist in the nav but the primary CTA is sales-gated.
## Top issues
1. **No OpenAPI specification was found at the 5 standard paths checked, so a client must be written from prose instead of generated.** (programmatic_onboarding)
2. **No security.txt file is published at the standard well-known path.** (machine_fetchable_trust)
3. **The signup form carries no validation constraints on any of its 13 inputs, leaving errors to surface only after submission.** (error_recovery)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/zapier-8dggw4
## Files generated from this scan
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/zapier-8dggw4
## The agent door
- **machine_discoverability** 100/100. robots.txt names all 8 major AI crawlers and allows them, a sitemap lists 1228 URLs, llms.txt is published, and key pages render without JavaScript. Nothing blocks discovery.
- **programmatic_onboarding** 40/100. Authentication is documented, endpoint examples are shown, code samples are provided.
- **pricing_legibility** 93/100. Three prices, $0, $19.99, $69, are readable without JavaScript on the pricing page, with Offer structured data and a machine readable pricing.md. Enterprise routes to sales, which is normal.
- **agent_aware_instrumentation** 90/100. An MCP manifest is published and pricing.md gives agents a machine readable price list, but the MCP endpoint only serves documentation search, not account or key provisioning, and the API itself is documented only in prose.
- **machine_fetchable_trust** 40/100. No security.txt file exists at the standard path. The homepage otherwise answers automated requests normally, so trust signals are thin but the site is not hostile to automation.
- **commercial_rails** 70/100. Prices are in raw HTML for Free, Professional and Team tiers, pricing.md is machine readable, and signup needs no sales call. But there is no published API for provisioning or billing, so an agent can read the price list but cannot.
## The human door
- **steps_to_first_value** 80/100. The 'Start free' entry is reached in 2 clicks from the homepage into a signup form with only 4 fields, none required, plus Google SSO. That is a short path to a working account.
- **required_fields** 98/100. The signup form asks for work email, first and last name, or Google SSO, with 0 of 4 fields marked required and no password field shown up front. Almost nothing stands between a visitor and an account.
- **verification_walls** 80/100. No verification step appears on the signup page itself, and Google SSO bypasses email verification entirely for those who use it. The walk did not observe what happens after submission.
- **error_recovery** 35/100. 0 of 13 inputs on the signup form carry validation constraints and there are no inline error containers, only 3 live regions. A mistyped field has little on-page feedback to recover from.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp