Fixed
Core V3 calls now work when an Authorization header is also sent
November 11th, 2026
Core V3 calls with a valid X-Yotpo-Token used to fail with 401 Bad token; invalid JSON when the request also had an Authorization header. That broke calls made through the docs MCP from AI clients that add their own Authorization header.
That's fixed: an Authorization header sent along with a valid X-Yotpo-Token is now ignored. If you removed the header from your MCP config to work around this, you can leave it either way.
Always send your access token in X-Yotpo-Token. A request with only an Authorization header still gets 401. See Connect to Yotpo MCP.