Updated Oct 2026

Google reviews API in PHP: Places, Business Profile and WordPress

Most PHP requests for a “Google reviews API” come from a WordPress or Laravel site that wants to show reviews, and a smaller number from agencies that want to manage them. Those are two different Google APIs. The Places API gives up to 5 public reviews of any place with an API key, which is what you want for a widget. The Business Profile API gives every review of locations you own and lets you reply, through OAuth and after Google approves your Cloud project. This guide shows both in PHP, then the same through Prisma. Background: Google reviews API: Places vs Business Profile.

1. Places API with cURL: 5 reviews for a widget

Create an API key restricted to the Places API (New) (step by step) and keep it on the server, never in the page.

<?php
$placeId = 'ChIJN1t_tDeuEmsRUsoyG83frY4';
$ch = curl_init("https://places.googleapis.com/v1/places/{$placeId}");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'X-Goog-Api-Key: ' . getenv('GOOGLE_MAPS_API_KEY'),
        'X-Goog-FieldMask: displayName,rating,userRatingCount,reviews',
    ],
]);
$place = json_decode(curl_exec($ch), true);
curl_close($ch);

echo $place['displayName']['text'], ' ', $place['rating'], ' (', $place['userRatingCount'], ")\n";
foreach ($place['reviews'] ?? [] as $r) {
    echo $r['rating'], ' ', $r['authorAttribution']['displayName'], ': ', $r['text']['text'] ?? '', "\n";
}

In WordPress, wrap it in a shortcode and cache the array with set_transient('google_reviews', $place, DAY_IN_SECONDS) so the key isn’t hit on every page view: each call is a billed Place Details request. You get at most 5 reviews, chosen by Google, with no owner replies. Show Google’s attribution as its terms require.

2. Business Profile API with google/apiclient: all reviews, with replies

Prerequisites: a Cloud project with the Business Profile APIs enabled and access approved by Google (quota is 0 until then), an OAuth client ID for a web app, and a sign-in by the owner or manager of the profile.

composer require google/apiclient

Sign in once and keep the refresh token

<?php
require 'vendor/autoload.php';

$client = new Google\Client();
$client->setClientId(getenv('GOOGLE_CLIENT_ID'));
$client->setClientSecret(getenv('GOOGLE_CLIENT_SECRET'));
$client->setRedirectUri('https://example.com/oauth/callback.php');
$client->setScopes(['https://www.googleapis.com/auth/business.manage']);
$client->setAccessType('offline');
$client->setPrompt('consent');

// 1) send the owner to $client->createAuthUrl();
// 2) in callback.php: $token = $client->fetchAccessTokenWithAuthCode($_GET['code']); store $token['refresh_token']
$client->refreshToken(getenv('GOOGLE_REFRESH_TOKEN'));
$http = $client->authorize();   // a Guzzle client that adds the Bearer token

Account, location, reviews

$get = fn(string $url) => json_decode((string) $http->get($url)->getBody(), true);

$account  = $get('https://mybusinessaccountmanagement.googleapis.com/v1/accounts')['accounts'][0]['name'];   // accounts/123
$location = $get("https://mybusinessbusinessinformation.googleapis.com/v1/{$account}/locations?readMask=name,title")['locations'][0]['name']; // locations/456

$stars = ['ONE' => 1, 'TWO' => 2, 'THREE' => 3, 'FOUR' => 4, 'FIVE' => 5];
$pageToken = null;
do {
    $url = "https://mybusiness.googleapis.com/v4/{$account}/{$location}/reviews?pageSize=50" . ($pageToken ? "&pageToken={$pageToken}" : '');
    $data = $get($url);
    foreach ($data['reviews'] ?? [] as $rev) {
        echo $stars[$rev['starRating']], ' ', $rev['reviewer']['displayName'], ': ', $rev['comment'] ?? '', isset($rev['reviewReply']) ? ' [replied]' : '', "\n";
    }
    $pageToken = $data['nextPageToken'] ?? null;
} while ($pageToken);

Reply, edit or delete

$http->put("https://mybusiness.googleapis.com/v4/{$rev['name']}/reply", [
    'json' => ['comment' => "Thank you, Laura. We've passed your note to the kitchen team."],
]);
// the same PUT edits an existing reply; $http->delete(".../reply") removes it

Limits: 300 queries per minute per project, 10 reply edits per minute per profile, 4,096 bytes per reply. Store the refresh token encrypted, and plan for Google re-reviewing the project (quota and 429s).

3. Prisma: one key for Google and 50+ other platforms

The owner connects the location once; your PHP never sees Google tokens, and the same code reads Tripadvisor, Trustpilot, the app stores or Yelp.

<?php
$h = ['Authorization: Bearer ' . getenv('PRISMA_API_KEY'), 'Content-Type: application/json'];
$ch = curl_init('https://api.prismareviews.com/v1/reviews?limit=100');
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $h]);
$reviews = json_decode(curl_exec($ch), true)['data'];
foreach ($reviews as $r) echo $r['platform'], ' ', $r['rating'], ' ', $r['author'], ': ', $r['text'], "\n";

$ch = curl_init("https://api.prismareviews.com/v1/reviews/{$reviews[0]['id']}/reply");
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $h, CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode(['text' => "Thank you, Laura. We've passed your note to the kitchen team."])]);
curl_exec($ch);

In WordPress, use wp_remote_get() and wp_remote_post() with the same headers, and register a webhook with POST /v1/webhooks pointing at a REST route so new reviews arrive without polling (webhooks reference). Test keys (pk_test_…) return sample reviews from every platform, so the code runs before any account is connected.

What’s true today: Prisma reads Google reviews from the Google Maps listing (public, read-only) while Google reviews Prisma’s Business Profile API application; replies on Google through Prisma start when that approval arrives. Replies already work by API on the App Store, Google Play, Judge.me, eBay, Trusted Shops, eKomi, WooCommerce and Wix (Platforms).

FAQ

How do I show Google reviews on a WordPress site with PHP?

Call the Places API from the server with a key restricted to the Places API, cache the response with a transient for a day, and render the up to 5 reviews with Google’s attribution. For all reviews of your own listing you need the Business Profile API with OAuth and Google’s approval, or a service that already has it.

Does google/apiclient support the Business Profile reviews API?

It handles the OAuth part and has service classes for accounts and locations, but reviews live on the v4 endpoints without a service class, so you call them with the authorized Guzzle client the library gives you.

Why does my PHP code only return 5 reviews?

Because it uses the Places API, which returns at most 5 reviews per place and no replies. Every review of a location you own comes from the Business Profile API after Google approves your project.