How to authenticate with the Yotpo Loyalty API using your GUID and API key.
🔐 Authentication
Yotpo uses a combination of your GUID and API Key to authenticate all API requests.
You can find your credentials in your Loyalty settings.
Need help finding your API credentials? Click here for instructions
🔧 Authentication via HTTP headers
When authorizing requests with headers:
- Set the
Content-Typetoapplication/json - Pass both the
GUIDandAPI Keyin custom headers
Required headers
| Header | Example Value | Notes |
|---|---|---|
Content-Type | application/json | Required for JSON payloads |
X-GUID | YOUR_GUID | Replace with your actual GUID |
X-API-KEY | YOUR_API_KEY | Replace with your actual API key |
🚫 Query parameters are not recommended
The API also accepts the GUID and API key as guid and api_key query parameters, but don't use them. Credentials in a URL end up in server logs, proxies and browser history, where others can read them. Send them in the X-GUID and X-API-KEY headers, and keep them on your server.
If your integration sends credentials in the URL today, move them to the headers.
🔑 Other credentials
- Reward Instances and the v3.0 VIP Tiers endpoints use a Yotpo access token in the
X-Yotpo-Tokenheader instead of the GUID and API key. See Yotpo Authentication. - Product Potential Points (v3.0) needs no credentials. Its authenticated version takes customer headers; see its reference page.