One access token authenticates every Yotpo API on api.yotpo.com: V3, Reviews V1 and Core V1. Generate it with your store ID and API secret, then send it in the X-Yotpo-Token header.
Merchant endpoints on api.yotpo.com use one access token, whatever the API version. Generate it from your store ID and API secret with Generate access token, then send it on every call:
X-Yotpo-Token: YOUR_ACCESS_TOKENThe same token works on V3 endpoints (/core/v3/...), Reviews V1 endpoints and Core V1 endpoints. A request without a valid token returns 401 (or 403 when the header is missing on some V1 paths). See Errors.
Exceptions
| Endpoints | How to send the token |
|---|---|
Storefront endpoints on api-cdn.yotpo.com and storefront.yotpo.com/loyalty | No token. They're public, so you can call them from browser code. |
Reviews Insights (/insights/v1/...) | Authorization: Bearer YOUR_ACCESS_TOKEN. The X-Yotpo-Token header isn't read. |
Custom albums (GET /albums/{store_id}) | As the utoken query parameter. The header isn't read. |
Loyalty API (V2) on loyalty.yotpo.com | Your Loyalty GUID and API key, in the x-guid and x-api-key headers. See Loyalty authentication. |
App partners on developers.yotpo.com | A per-store OAuth token you get when a merchant installs your app. See Authenticating with OAuth 2.0. |
Moving from utoken
V1 calls used to take the token as utoken in the query string or body. They still accept it there, but send it in the X-Yotpo-Token header instead: URLs end up in logs. The V1 token endpoint (POST /oauth/token) returns the same token as Generate access token, so you don't need a separate one for V1.
Keep the token safe
Generate and use the token on your server only. Never put your API secret or the token in browser or mobile code, and never commit them to a repository. When a call returns 401, generate a new token and retry once.