Improved
Loyalty · Send your GUID and API key in headers only
October 25th, 2026
The Authentication page now documents the X-GUID and X-API-KEY headers as the way to authenticate. The API still accepts guid and api_key as query parameters, but we no longer recommend them: credentials in a URL end up in server logs, proxies and browser history.
If your integration sends credentials in the URL, move them to the headers. The page also lists the other credentials: an X-Yotpo-Token for Reward Instances and the v3.0 VIP Tiers API, and none for Product Potential Points.