Google Reviews API for Developers

Authentication

Generate an API key from Settings → API in your dashboard. Each key is shown only once when created — store it somewhere safe. Send it in the Authorization header of every request:

curl -H "Authorization: Bearer rvd_live_..." \
  "https://reviews-api.rovidev.com/api/v1/locations"

GET /api/v1/locations

Returns your organization's active locations.

{
  "id": "b3f1...",
  "name": "Cafetería El Sol - Centro"
}

GET /api/v1/reviews

Returns your organization's reviews, paginated. Supports the status (pending, negative, published), location_id, platform (google, facebook, tripadvisor), page and page_size filters.

curl -H "Authorization: Bearer rvd_live_..." \
  "https://reviews-api.rovidev.com/api/v1/reviews?status=negative&page=1&page_size=50"

{
  "items": [
    {
      "id": "9c2a...",
      "location_id": "b3f1...",
      "location_name": "Cafetería El Sol - Centro",
      "platform": "google",
      "star_rating": 5,
      "comment": "Trato excelente",
      "reviewer_name": "Ana",
      "sentiment": "positive",
      "review_created_at": "2026-08-20T10:15:00",
      "reply_status": "published",
      "reply_content": "¡Muchas gracias, Ana!"
    }
  ],
  "total": 1,
  "page": 1,
  "page_size": 50
}

Also in JavaScript / Node

const res = await fetch(
  "https://reviews-api.rovidev.com/api/v1/reviews?status=negative&page=1&page_size=50",
  { headers: { Authorization: "Bearer rvd_live_..." } }
)
const { items, total } = await res.json()

POST /api/v1/review-requests

Trigger a review request the moment an order, booking, or appointment is completed, instead of relying on uploading a contact list by hand. Supports the email, sms, and whatsapp channels.

curl -X POST -H "Authorization: Bearer rvd_live_..." \
  -H "Content-Type: application/json" \
  -d '{"channel":"email","name":"Ana","email":"ana@example.com"}' \
  "https://reviews-api.rovidev.com/api/v1/review-requests"

{
  "id": "7e4b...",
  "status": "sent",
  "channel": "email",
  "recipient": "ana@example.com"
}

Also in JavaScript / Node

await fetch("https://reviews-api.rovidev.com/api/v1/review-requests", {
  method: "POST",
  headers: {
    Authorization: "Bearer rvd_live_...",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({ channel: "email", name: "Ana", email: "ana@example.com" })
})

Webhooks

Configure a URL from Settings → API to receive a POST every time an event happens, instead of polling the API on a schedule. Maximum 5 active webhooks per organization.

Available events

• review.created
• review.replied
• daily.summary

Verifying the signature

Every delivery includes an X-RoviDev-Signature header: an HMAC-SHA256 of the request body, computed with the secret shown to you when the webhook is created. Verify it on your server before processing the event:

import hashlib
import hmac

expected = hmac.new(secret.encode(), request.body, hashlib.sha256).hexdigest()
hmac.compare_digest(expected, request.headers["X-RoviDev-Signature"])

Also in JavaScript / Node

const crypto = require("crypto")

const expected = crypto
  .createHmac("sha256", secret)
  .update(rawBody)
  .digest("hex")
crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(req.headers["x-rovidev-signature"]))