Testing your integration

The UGC API has no sandbox or test mode. Every request reaches a real Yotpo store, including requests sent from Try It on the reference pages, which use whatever store ID and token you enter.

Use a separate test store

Test against a Yotpo store you keep only for testing, with its own store ID and API secret. Don't test against your live store: some calls email shoppers, and some changes can't be undone.

Keep the store ID and API secret in configuration, not in code, so you can switch from the test store to the live store without changing code.

Calls that are safe to repeat

These only read data:

All storefront endpoints on api-cdn.yotpo.com (v1 widget endpoints and V3 storefront endpoints).
GET requests to merchant endpoints.
The search and Insights endpoints, which use POST but only read.

Calls with side effects

Endpoint	What happens	How to test it safely
Create review, Create review (synchronous)	Creates a review and sends a review verification email to the reviewer's address. Published reviews appear on your storefront.	Use `example.com` addresses, or an inbox you own if you need to see the email. There's no API to delete a review, so plan to remove test reviews in the Yotpo admin.
Upload images with reviews, Import images	Adds photos to reviews or galleries that shoppers can see.	Use the test store, and remove the media in the Yotpo admin afterwards.
Create question (with confirmation email)	Creates a question and emails the asker a confirmation.	Use `example.com` addresses, or use Create question (without confirmation email).
Create an answer	A public answer appears on the product page.	Answer test questions only.
Upvote or downvote reviews, Vote on answers	Changes the helpful counts shoppers see.	Vote on test reviews and answers only.
Add metadata, Update review metadata	Adds or changes a review's metadata. Metadata can't be removed once added.	Use test reviews only.
Update incentivized reviews	Changes which reviews show the incentivized badge.	Use test reviews only.
Upload dynamic coupon codes, Delete a coupon action's codes	Adds or removes the coupon codes sent in review-request emails.	Use the test store. Deleting removes all codes for that coupon action.
Remove email addresses, Re-add email addresses	Stops, or resumes, Yotpo emails to those addresses.	Use `example.com` addresses.
GDPR Delete	Permanently deletes or anonymizes a person's data. It can't be undone.	Only use addresses you created for the test.

Test data rules

Use example.com email addresses. The domain is reserved, so mail sent there is never delivered. When you need to receive an email, use an inbox you own. Never use real customers' addresses.
Use product IDs that exist in the test store. Remember that storefront endpoints return 200 with no reviews for an unknown product ID (see Errors), so a typo looks like "no reviews yet".
Keep a list of everything you create (reviews, questions, answers, images, unsubscribed addresses) so you can clean up.
Storefront data can lag by up to 3 hours, and new reviews go through moderation first. A review you just created won't appear on storefront endpoints right away.

Rate limits apply during tests

Test traffic counts against the same limits as live traffic. Run load tests against the test store, not the live one, and handle 429 responses as described in Errors.

Before you go live

Your API secret and access tokens are used only on your server and never reach the browser.
Your code requests a new token after a 401 and retries once.
Your code backs off on 429 and retries reads on 500, but doesn't blindly retry create calls.
Storefront responses are cached on your side.
The live store ID and API secret come from configuration.
Product IDs match the IDs your platform sends to Yotpo.
Test reviews, questions and media are removed from any store shoppers can see.

Building review widgets? Also run the Testing and go-live checklist in the custom widgets guide.