This endpoint uses your Yotpo Store ID (app_key) and API secret to generate the API access token necessary to authenticate most of Yotpo's API calls. Learn how to find your store ID (app_key) and API secret in Finding your Yotpo app key and API secret.
Use this token to integrate one merchant's store: it needs that store's API secret. Building an app that many merchants install? Use the app partners Generate access token (OAuth 2.0) instead.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Where to find your API secretOnly Yotpo account admins can see the API secret. Users with staff permissions can't. If you keep getting
401with "The Store ID or Secret you have provided is invalid", ask an admin for the secret and check it matches the store ID in the path. See App key vs. Store ID.
How long a token lastsA token has no fixed expiry, and the response doesn't include one. Requesting a token again returns the same token while it's still valid, so request it at the start of each sync run (or once a day) instead of storing it indefinitely.
A token stops working when the API secret is rotated or the account is deactivated, and tokens that aren't requested again are cleaned up over time. When a call returns
401, generate a new token and retry once.
One token for V3 and V1This token also authenticates Reviews V1 and Core V1 calls: send it in the
X-Yotpo-Tokenheader. The older V1 token endpoint,POST https://api.yotpo.com/oauth/tokenwithclient_id,client_secretandgrant_type: client_credentials, returns the same token, so existing V1 integrations keep working. See About authentication.