Updated Oct 2026

Yotpo API in Python: token, reviews, incremental sync

Yotpo’s reviews API is one token call and one reviews endpoint, paginated 100 at a time, with a filter for incremental syncs. It is read-only for replies, which matters if you planned to answer from your tool. This guide covers the flow with requests exactly as Prisma’s Yotpo connector does it, then the same through Prisma. The e-commerce picture across Yotpo, Judge.me, Loox and the rest is on e-commerce reviews API.

pip install requests

From the Yotpo admin: the Store ID (also called app key) and the API secret.

1. Get a utoken (lasts about 14 days)

import os, requests

API = "https://api.yotpo.com"
STORE_ID = os.environ["YOTPO_STORE_ID"]

def new_token():
    r = requests.post(f"{API}/oauth/token", json={"client_id": STORE_ID, "client_secret": os.environ["YOTPO_API_SECRET"], "grant_type": "client_credentials"}, timeout=30)
    r.raise_for_status()
    return r.json()["access_token"]

TOKEN = new_token()

The token is sent as the X-Yotpo-Token header. It expires after roughly two weeks; the simplest policy is to request a new one whenever a call returns 401.

2. Page through the reviews

def reviews(since_updated_at=None):
    global TOKEN
    page = 1
    while True:
        params = {"count": 100, "page": page}
        if since_updated_at:
            params["since_updated_at"] = since_updated_at       # ISO 8601; only reviews changed after this
        r = requests.get(f"{API}/v1/apps/{STORE_ID}/reviews", headers={"X-Yotpo-Token": TOKEN, "Accept": "application/json"}, params=params, timeout=30)
        if r.status_code == 401:
            TOKEN = new_token(); continue
        r.raise_for_status()
        batch = r.json().get("reviews", [])
        if not batch:
            break
        yield from batch
        page += 1

for rev in reviews():
    if rev.get("deleted"):
        continue
    reply = (rev.get("comment") or {}).get("content")
    print(rev["id"], rev["score"], rev.get("title"), (rev.get("content") or "")[:80], rev.get("name"), rev.get("sku"), "| replied" if reply else "")

Each review has id, score (1 to 5), title, content, name (reviewer), sku, created_at, updated_at and deleted. The merchant’s reply, when present, comes as comment.content with comment.created_at; it isn’t in Yotpo’s documentation but it is in the response, so read it defensively. Yotpo’s own data can take up to an hour to show a new review.

3. Incremental sync

Store the newest updated_at you’ve seen and pass it as since_updated_at next time; edited reviews and new merchant comments change updated_at, so they come back too. Reviews with deleted: true should be removed from your store.

4. What the API won’t do

• Reply: there is no endpoint in this API to post a merchant comment. Replies are written in the Yotpo admin.
• Unpublished reviews: the endpoint returns the published set for the store; moderation happens in Yotpo.
• Webhooks: Yotpo offers webhooks on some plans for events such as review creation; the reviews endpoint itself is poll-only.

5. The same job through Prisma

Prisma connects a Yotpo store with the Store ID and API secret (checked against Yotpo before they’re stored, encrypted), renews the token itself, syncs incrementally, drops deleted reviews and returns the reply in the same shape as every other platform. One key then covers Yotpo, Judge.me, Loox, Okendo, Trustpilot, Google and 50+ other platforms, with a review.created webhook per new review.

H = {"Authorization": f"Bearer {os.environ['PRISMA_API_KEY']}"}
r = requests.get("https://api.prismareviews.com/v1/reviews", headers=H, params={"platform": "yotpo", "since": "2026-10-01", "limit": 100}, timeout=30)
for rev in r.json()["data"]:
    print(rev["rating"], rev["author"], rev["title"], rev["text"], rev["reply"] and rev["reply"]["text"])

Yotpo is read-only in Prisma too, like on Yotpo; each review carries its url. Connection fields: Yotpo on Platforms. Yotpo is included from the Beam plan up. A test key returns sample Yotpo reviews so the code runs today.

FAQ

Where do I find the Yotpo Store ID and API secret?

In the Yotpo admin under Settings → General settings (Store ID, also called app key) and the API secret next to it. The Store ID is public and goes in URLs; the secret stays server-side and is only used to get a utoken.

Can I reply to Yotpo reviews by API?

Not through the merchant reviews API used here: it returns reviews and the existing merchant comment but has no documented endpoint to post one. Replies are written in the Yotpo admin.

How long does a Yotpo utoken last?

About 14 days. Request a new one with the client-credentials call when you get a 401, and send it as the X-Yotpo-Token header.