Updated Oct 2026

Trustpilot API Key: How to Get Your Credentials and Make Your First Call

A Trustpilot API key is created when you set up an API application in your Trustpilot Business account. You get two values: the API key (the client ID) and the API secret (the client secret). The key alone, sent in an apikey header, opens Trustpilot’s public endpoints. To reply to reviews or read private data you exchange the key and secret for an OAuth 2.0 access token, which lasts 100 hours. API access itself is sold as the API module, a paid add-on for Trustpilot for Business.

For the bigger picture (public vs private endpoints, rate limits, what the docs leave out), read our Trustpilot API overview.

Trustpilot API key vs secret: what each one does

Trustpilot’s authentication docs advise against passing the key or a token in a query string, because URLs end up in logs.

How to get a Trustpilot API key, step by step

Step 1 — Check that your plan includes API access

Trustpilot sells API access as the API module, an add-on for Trustpilot for Business. It lists three tiers: 200,000 calls a year (Tier 1), 1,000,000 calls a year (Tier 2) and unlimited (Tier 3). Enterprise plans include Tier 1. The price isn’t published, so talk to your Trustpilot account manager before you build. If your account has no API access yet, you have to request it from Trustpilot.

Step 2 — Create an API application in Trustpilot Business

Log in to Trustpilot Business and go to Integrations → Developers → APIs. Under your applications, choose Create Application and give it a name that describes the integration, such as “Support desk sync”. If you’ll use the authorization code grant, add your redirect URI here too.

Step 3 — Copy the key and secret

Trustpilot shows the API key and API secret for the new application. Store both in a secrets manager or environment variables. Never ship the secret in front-end code, a mobile app or a public repo.

Step 4 — Find your business unit ID

Every Trustpilot call is scoped to a business unit (your domain’s profile). Look it up with the public find endpoint:

curl -H "apikey: YOUR_API_KEY" \
  "https://api.trustpilot.com/v1/business-units/find?name=example.com"

Keep the id from the response. You’ll use it in every review call.

Step 5 — Read your public reviews

curl -H "apikey: YOUR_API_KEY" \
  "https://api.trustpilot.com/v1/business-units/BUSINESS_UNIT_ID/reviews"

Step 6 — Get an OAuth access token for private endpoints

Pick the grant that matches your case:

Token requests authenticate with Authorization: Basic base64(API_KEY:API_SECRET). For client credentials (grant docs):

curl -X POST \
  -u "YOUR_API_KEY:YOUR_API_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  "https://api.trustpilot.com/v1/oauth/oauth-business-users-for-applications/accesstoken" \
  -d "grant_type=client_credentials"

Access tokens expire after 100 hours; refresh tokens after 30 days. Refresh tokens only come with the authorization code and password grants; with client credentials you request a new token with the same call once the old one expires. Use expires_in to schedule it, and don’t renew early: Trustpilot returns 429 if you request new tokens too often.

Step 7 — Reply to a review

// Node 18+
async function replyOnTrustpilot({ reviewId, message, businessUserId, accessToken }) {
  const res = await fetch(`https://api.trustpilot.com/v1/private/reviews/${reviewId}/reply`, {
    method: "POST",
    headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
    body: JSON.stringify({ authorBusinessUserId: businessUserId, message }),
  });
  if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
}

# Python 3
import requests

def reply_on_trustpilot(review_id, message, business_user_id, access_token):
    r = requests.post(
        f"https://api.trustpilot.com/v1/private/reviews/{review_id}/reply",
        json={"authorBusinessUserId": business_user_id, "message": message},
        headers={"Authorization": f"Bearer {access_token}"},
    )
    r.raise_for_status()

To remove a reply, send DELETE to the same URL with the business user token. The endpoints are in the Service Reviews API reference.

Common errors with Trustpilot API keys

Keep your Trustpilot credentials safe

• One API application per integration, so you can revoke one without breaking the rest.
• Secret and tokens only on the server. Rotate the secret if it ever reaches a log or a repo.
• Encrypt tokens at rest and record who triggered each reply.

FAQ

Is the Trustpilot API free?

No. Trustpilot sells API access as the API module, a paid add-on for Trustpilot for Business with tiers of 200,000, 1,000,000 or unlimited calls per year. Enterprise plans include Tier 1.

What is the difference between the Trustpilot API key and secret?

The API key (client ID) identifies your application and is enough for public endpoints via the apikey header. The secret is used with the key to get OAuth access tokens for private endpoints such as replying to reviews.

How long do Trustpilot access tokens last?

Access tokens expire after 100 hours and refresh tokens after 30 days. Requesting new tokens too often returns HTTP 429.

Which OAuth grant should I use with Trustpilot?

Client credentials for server-to-server access to your own domain, authorization code when acting on behalf of other Trustpilot business users. The password grant is deprecated.

Can I reply to Trustpilot reviews through the API?

Yes: POST /v1/private/reviews/{reviewId}/reply with authorBusinessUserId and message, using a business user access token. The same pattern works for replying to Google reviews, with different auth.

curl "https://api.prismareviews.com/v1/reviews?platform=trustpilot&since=2026-10-01" \
  -H "Authorization: Bearer $PRISMA_API_KEY"