Testing your integration

The App Developer API has no sandbox or test mode. Every request reaches a real Yotpo store, including requests sent from Try It on the reference pages, which use whatever store ID and token you enter.

Use a test account

Build and test against the Yotpo test account you opened when you registered your app. Install your app on it through the normal install flow, so you test the same OAuth steps a merchant goes through. Never test against a merchant's live store without their agreement: some calls change what shoppers see, and some can't be undone.

Keep your app ID, app secret and each store's access token in configuration or a secrets store, not in code.

Calls that are safe to repeat

These only read data:

GET requests on developers.yotpo.com.
Best Reviews and Best Sentences, which use POST to pass filters but only read.
All storefront endpoints on api-cdn.yotpo.com, including the review search endpoints that use POST.
Product Potential Points, which uses POST but only calculates.

Calls with side effects

Endpoint	What happens	How to test it safely
Update Order Fulfillment	Changes the order's fulfillment. Yotpo times review requests from fulfillment data, so a test update can lead to a review request email.	Use orders in your test account whose customers have `example.com` addresses.
Create or Update Customer	Creates or updates a customer record in the store.	Use `example.com` addresses.
Publish/Unpublish Reviews	Changes which reviews shoppers see on the store's widgets.	Use test reviews only.
Create New Comment, Update Existing Comment, Delete Comment	Adds, changes or removes the comment on a published review.	Comment on test reviews only.
Adjust Loyalty Customer Points, Record Loyalty Customer Action	Changes the customer's points balance and history. The resulting loyalty events can reach the merchant's other tools, such as email or SMS flows.	Use test customers with `example.com` addresses, and small amounts.
Webhook targets, filters and subscriptions	Real events are delivered to your target URL. A target that a subscription uses can't be deleted until you delete or update that subscription.	Point test targets at an endpoint you control, and clean up test subscriptions.
Remove Application	Deletes the access token. The merchant has to install your app again before you can call their store.	Use it on your test account to test your uninstall flow, then reinstall.
Vote on Answers	Changes the vote counts shoppers see.	Vote on test answers only.

Test data rules

Use example.com email addresses. The domain is reserved, so mail sent there is never delivered. When you need to receive an email, use an inbox you own. Never use real customers' addresses.
Use product and order IDs that exist in your test account. Storefront endpoints return 200 with no reviews for an unknown product ID (see Errors), so a typo looks like "no reviews yet".
Keep a list of everything you create (customers, comments, point adjustments, webhook targets and subscriptions) so you can clean up.

Before you go live

Your app secret and access tokens are used only on your server and never reach the browser.
You store one token per store and send it in the X-Yotpo-Token header.
After 3 401 invalid_token responses in a row for a store, your product shows the integration as disconnected and lets the merchant reinstall (see Errors).
Merchants can uninstall from your product (Remove Application) and from Yotpo (the app uninstall event in Yotpo Events).
Your webhook endpoint answers quickly with 200 and ignores duplicate deliveries (see About Webhooks).
Test data is removed from any store shoppers can see.

When everything above passes, certify and launch your integration.