Updated Oct 2026

Google, Trustpilot and App Store reviews in Zapier and Make (webhook setup)

Zapier and Make each have a Google Business Profile app, and nothing for the App Store, Google Play, Trustpilot, Yelp, Tripadvisor or Booking.com. Prisma gives both tools one trigger for all of them: a signed webhook per new review, with the same JSON whatever the platform. This guide sets it up end to end, with the one gotcha (the payload carries ids, not the text) handled. If you use n8n, the Slack alerts workflow is the equivalent with the native node.

1. Create the catch hook

• Zapier: new Zap → Trigger: Webhooks by Zapier → Catch Hook → copy the custom webhook URL.
• Make: new scenario → Webhooks → Custom webhook → Add → copy the address.

Leave the step waiting for data; the next step sends the first event.

2. Register the hook with Prisma

Once, from your terminal (or an HTTP step in the same tool), with your API key from the dashboard:

curl -X POST https://api.prismareviews.com/v1/webhooks \
  -H "Authorization: Bearer $PRISMA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://hooks.zapier.com/hooks/catch/123456/abcdef/", "events": ["review.created"]}'

The response includes a secret shown once; keep it if you want to verify signatures (section 5). Prisma sends a test-shaped event the moment a review is synced; with a test key (pk_test_…) sample reviews arrive within minutes, so the Zap or scenario can be built before any real account is connected.

The payload is small on purpose:

{
  "id": "evt_01KJ8Q2M4T7HX3VB9CWD6NRZ5E",
  "type": "review.created",
  "created_at": "2026-10-21T09:00:03.000Z",
  "data": { "id": "rev_01KJ8Q2M4T7HX3VB9CWD6NRZ5E", "location_id": "loc_01KJ8P9W2C4D6F8G0H2J4K6M8N", "platform": "google" }
}

3. Fetch the review

Add an HTTP step right after the trigger:

• Zapier: Webhooks by Zapier → Custom Request (or GET). URL https://api.prismareviews.com/v1/reviews/{{data__id}}, header Authorization: Bearer pk_live_….
• Make: HTTP → Make a request. URL https://api.prismareviews.com/v1/reviews/{{1.data.id}}, header Authorization: Bearer pk_live_…, parse response: yes.

You get the full review:

{
  "id": "rev_01KJ8Q2M4T7HX3VB9CWD6NRZ5E", "platform": "google", "location_id": "loc_…",
  "rating": 2, "title": null, "text": "Great food, 40 minutes for the bill.", "author": "Laura M.",
  "language": "en", "created_at": "2026-10-21T08:40:00.000Z", "reply": null,
  "url": "https://search.google.com/local/reviews?placeid=…"
}

Keep the API key in the tool’s connection or a secret field, never in a URL.

4. Route and act

Typical branches, with the fields from step 3:

Map location_id to a readable name once with GET /v1/locations (store it in a lookup table in the tool).

4b. Reply from Zapier or Make

Another HTTP step, POST:

URL:     https://api.prismareviews.com/v1/reviews/{{data__id}}/reply
Headers: Authorization: Bearer pk_live_…   Content-Type: application/json
Body:    {"text": "Thank you, {{author}}! Glad you enjoyed it, see you soon."}

Prisma queues it, publishes through the platform’s official API and sends reply.published or reply.failed (subscribe to those events in step 2 to see the outcome in the same tool). Put a human approval step before this for anything under 4 stars: a Slack button, an Airtable status, or a Zapier “Delay until” plus a checkbox. Prisma never writes the text; it publishes what you send.

Where replies work today: App Store, Google Play, Judge.me, eBay, Trusted Shops, eKomi, WooCommerce, Wix, Junip, Fera, Shopware, Hostaway. Google Business Profile and Trustpilot join when each approves Prisma’s access. Read-only platforms return reply_not_supported with the link (Platforms).

5. Verify the signature (optional, recommended)

Every delivery carries Prisma-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256> where the signature is the HMAC of <timestamp>.<raw body> with the endpoint’s secret. In Zapier, a Code by Zapier (Python) step can check it before anything else runs:

import hashlib, hmac
t, v1 = [p.split("=", 1)[1] for p in input_data["signature"].split(",")]
expected = hmac.new(input_data["secret"].encode(), f"{t}.{input_data['raw_body']}".encode(), hashlib.sha256).hexdigest()
output = {"ok": hmac.compare_digest(expected, v1)}

Pass the raw body and the header into the step from the trigger. In Make, the Crypto module computes the HMAC the same way. Retries keep the same event id, so de-duplicate on it. Details and other languages: webhooks reference.

FAQ

Does Zapier have a Google reviews trigger?

Zapier has a Google Business Profile app with a new-review trigger for accounts you authorise, Google only. Prisma’s webhook covers Google plus the App Store, Google Play, Trustpilot, Yelp, Tripadvisor and 40+ more with one trigger and one JSON.

Why doesn’t the webhook include the review text?

Webhook payloads carry the event type and the ids (review, location, platform), not the full review, so a leaked webhook URL never leaks review content. One HTTP step with your API key fetches the review.

Can I reply from Zapier or Make?

Yes, with an HTTP step: POST /v1/reviews/{id}/reply with the text. It works where the platform’s official API allows replies (App Store, Google Play, Judge.me, eBay and others; Google and Trustpilot once they approve Prisma’s access). Read-only platforms return reply_not_supported with the link.