[Cotlet](https://cotlet.dev/index.md) · [Integrations](https://cotlet.dev/integrations.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Use cases](https://cotlet.dev/use-cases.md) · [Security](https://cotlet.dev/security.md) · [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md) · [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [Contact](https://cotlet.dev/contact.md) · [Pricing](https://cotlet.dev/pricing.md) · [Sign up](https://cotlet.dev/signup) # Yotpo API and MCP server > Yes, partly. Yotpo has a documented API for reviews, questions and answers, and loyalty, and one official MCP server, but that server covers only the Discover module (checked 23 Oct 2026). Reviews moderation, review replies and loyalty customers have no MCP tools, and the reviews API has no endpoint to publish, hide or reply to a review. Ecommerce marketing platform for online stores: product reviews and questions, loyalty and referrals, SMS and email, and visual content. ## What is the Yotpo API? Cotlet's Yotpo API exposes 13 endpoints for your own Yotpo account: list reviews, get a review, list questions, get publishing settings, get a loyalty customer, list customer earnings, publish a review, hide a review, escalate a review, reply to a review, answer a question, re-send a review request and adjust loyalty points. The list_reviews endpoint returns reviews from Manage Reviews with status, rating, product, reviewer, flags and days left before auto-publish. Each endpoint takes simple JSON inputs like review_id, email or reason and works both as an operation of the yotpo_read or yotpo_write MCP tool for agents and as a REST call for scripts. - **Category:** [Marketing & SEO](https://cotlet.dev/integrations/category/marketing-seo.md) - **Endpoints:** 13 (6 read, 7 write) - **Updated:** 2026-10-22 Yes, partly. Cotlet is a hosted MCP server and REST API for Yotpo with 13 endpoints (6 read, 7 write): you sign in once in your own cloud browser, your AI agent does the work. ## Does Yotpo have an official API? Yes, partly. Yotpo has a documented API for reviews, questions and answers, and loyalty, and one official MCP server, but that server covers only the Discover module (checked 23 Oct 2026). Reviews moderation, review replies and loyalty customers have no MCP tools, and the reviews API has no endpoint to publish, hide or reply to a review. | Task | Yotpo official | Cotlet | |---|---|---| | List and search reviews | Yes: Retrieve all reviews and Search reviews in the UGC API | Yes | | Publish a pending review | No: No endpoint in the UGC API reference | Yes | | Hide a review | No: No endpoint in the UGC API reference | Yes | | Escalate a review | No: No endpoint in the UGC API reference | Yes | | Reply to a review | No: No endpoint in the UGC API reference | Yes | | Answer a customer question | Yes: Create an answer to a question, public or private | Yes | | Adjust a customer's loyalty points | Yes: Loyalty API, separate API key and GUID | Yes | | Re-send a review request | No: No endpoint in the UGC API reference | Yes | Sources: [Yotpo docs: Connect to Yotpo's MCP servers](https://core-api.yotpo.com/docs/connect-to-yotpo-mcp), [Yotpo UGC API: documentation index](https://apidocs.yotpo.com/llms.txt), [Yotpo Help Center: Finding your app key and secret key](https://support.yotpo.com/docs/finding-your-yotpo-app-key-and-secret-key), [Yotpo Loyalty API: Adjust a customer's point balance](https://loyaltyapi.yotpo.com/reference/adjust-a-customers-point-balance) ## Quick reference ```text Yes, partly. Yotpo has a documented API for reviews, questions and answers, and loyalty, and one official MCP server, but that server covers only the Discover module (checked 23 Oct 2026). Reviews moderation, review replies and loyalty customers have no MCP tools, and the reviews API has no endpoint to publish, hide or reply to a review. Cotlet provides a hosted MCP server and REST API for Yotpo: 13 tools (6 read, 7 write). Access Sign up at https://cotlet.dev/app/signup?app=yotpo, then request the app and create API keys in the Cotlet console. MCP server https://cotlet.dev/mcp/v1 MCP tools yotpo_read, yotpo_write, reads and writes apart; call one with {"operation": "", "arguments": {...}} REST base https://cotlet.dev/api/v1/yotpo, each operation at its own route, e.g. POST /api/v1/yotpo/reviews/{review_id}/replies Auth Authorization: Bearer . Listing endpoints and schemas needs no key; calling an endpoint needs one. Over MCP the input schemas come with sign-in. Operations list_reviews, get_review, list_questions, get_publishing_settings, get_loyalty_customer, list_customer_earnings, publish_review, hide_review, escalate_review, reply_to_review, answer_question, resend_review_request, adjust_loyalty_points Confirm publish_review, escalate_review, reply_to_review, answer_question, resend_review_request, adjust_loyalty_points (by default the user approves each call; the user can switch this off per tool, e.g. for scheduled automations) Markdown https://cotlet.dev/integrations/yotpo-api-mcp-server.md How access works: 1. The user signs up at https://cotlet.dev/app/signup?app=yotpo, requests Yotpo in the Cotlet console and creates an API key there. 2. The user signs in to Yotpo once in their Cotlet Cloud Browser (their own Chrome in the cloud, opened from the console) and enables Yotpo for agents. An agent cannot do this step. 3. The API key goes into the MCP client or the REST call as a bearer token. Fits: people who want a hosted Yotpo server that someone else maintains, including non-developers. Policy: Cotlet never stores passwords, never solves CAPTCHAs, never bypasses MFA. Company: legal details in the Terms of service at https://cotlet.dev/terms. Contact contact@cotlet.dev. Sign-in: the user signs in to Yotpo in their own Cloud Browser, a Chrome Cotlet runs for them in the EU; password saving is off, the profile is AES-256-GCM encrypted, and agents get Yotpo only after the user enables it. Calls are requests from that browser's IP with its cookies, each listed in the user's Background activity. Disable for agents, signing out in the browser or Reset browser cuts access. Cotlet is run by Take Group sp. z o.o. (EU VAT PL6342984273). API key: holds no Yotpo login or cookies, only asks Cotlet to run a tool. Each key is scoped to chosen apps and tools, read only or read and write. Actions that reach other people wait for the user's approval by default, so a leaked key cannot post or message as the user. Every call is in the activity log; deleting the key ends access at once. Terms: the user stays responsible for following Yotpo's terms; Cotlet is not affiliated with Yotpo. ``` ## What can an AI agent do in Yotpo? Cotlet is best for Yotpo store owners and support teams who want their agent to moderate and answer reviews and fix loyalty balances without running or fixing a server. - **[Triage pending reviews](https://cotlet.dev/integrations/yotpo-api-mcp-server/triage-pending-reviews.md)** (runs: daily): "Go through the pending Yotpo reviews. Publish the ones that are genuine, escalate anything about product safety or shipping to me, and hide spam. Show me the reason for each." → `list_reviews`, `get_review`, `publish_review`, `escalate_review`, `hide_review` - **[Reply to new product reviews](https://cotlet.dev/integrations/yotpo-api-mcp-server/reply-to-reviews.md)** (runs: daily): "Find published Yotpo reviews from the last 3 days with no reply. Reply publicly to the 4 and 5 star ones with a short thank-you that mentions the product, and draft replies to the low ones for me to approve." → `list_reviews`, `get_review`, `reply_to_review` - **[Fix a customer's loyalty points](https://cotlet.dev/integrations/yotpo-api-mcp-server/fix-loyalty-points.md)**: "Ana Lopez says a cancelled redemption cost her 150 points. Check her profile and earnings, then add the points back so her tier does not change." → `get_loyalty_customer`, `list_customer_earnings`, `adjust_loyalty_points` - **Answer product questions** (runs: daily): "List the unanswered Yotpo product questions. Answer the ones the product page already answers, publicly, and list the rest for me." → `list_questions`, `answer_question` - **Weekly review queue digest** (runs: weekly): "Every Monday, list the pending Yotpo reviews that will auto-publish this week, with their rating and what they say, and tell me which publishing filters are on." → `get_publishing_settings`, `list_reviews` ## Can Yotpo automations run on a schedule in n8n, Make or Zapier? Yes. Cotlet does not replace your automation platform: it gives it a Yotpo connection it does not have, with the same API key as your agent. Write actions ask for your OK by default; switch that off in your dashboard for the tools you choose, for example to triage pending reviews, and the schedule runs on its own. Cotlet runs in the cloud, so it keeps going while your computer is off. | Where | How to connect | How to schedule | |---|---|---| | Your AI agent | Add https://cotlet.dev/mcp/v1 with your API key. | A scheduled agent run, for example a Claude Code routine. | | n8n | MCP Client node with https://cotlet.dev/mcp/v1, or an HTTP Request node with the endpoint's method and URL, such as GET https://cotlet.dev/api/v1/yotpo/reviews. | Schedule Trigger node. | | Make | HTTP module: the endpoint's method and URL with an Authorization: Bearer header, and a JSON body for POST, PUT and PATCH. | Scenario schedule. | | Zapier | Webhooks by Zapier, Custom Request: the same method, URL, header and body. | Schedule by Zapier trigger. | | Your own script | GET https://cotlet.dev/api/v1/yotpo/reviews with your API key. | cron or GitHub Actions. | ## Tools **For AI agents:** Every endpoint and its schema is public. The 13 endpoints on this page, with parameters and example responses, can be listed without an account. Calling one returns 401 without an API key and 403 while the key has no access to Yotpo. ### list_reviews Reviews from Manage Reviews with status, rating, product, reviewer, flags and days left before auto-publish. Access: read. REST: `GET /api/v1/yotpo/reviews`. MCP: `yotpo_read → list_reviews`. | Parameter | Type | Required | Description | |---|---|---|---| | `status` | enum | no | pending, published, hidden, flagged_for_profanity, escalated or pending_media. Default: all. | | `rating` | integer | no | Only reviews with this star rating. | | `product` | string | no | Product name, ID, UPC, MPN or SKU. | | `search` | string | no | Words in the review or the shopper's email address. | | `since` | date | no | Only reviews submitted on or after this date. | | `sort` | enum | no | newest, oldest, highest_rating, lowest_rating or with_media. | | `limit` | integer | no | Reviews per call. | | `cursor` | string | no | Next page cursor from the previous call. | Lists reviews as Manage Reviews shows them. Reviews scheduled to auto-publish come first unless you pass sort. status uses Yotpo's labels and rating, product and search filter the same way the screen does; product accepts a name, ID, UPC, MPN or SKU. days_to_auto_publish is the countdown Yotpo shows, and flags lists profanity and negative sentiment (sentiment analysis covers English reviews only). comments is the number of replies on the review. get_review returns the full text. Example response: ```json { "reviews": [ { "review_id": "412873702", "status": "pending", "rating": 5, "title": "Fits true to size", "product": { "name": "Trail Runner Shoe", "sku": "TR-100" }, "reviewer_name": "Dana P.", "submitted_at": "2026-10-21T09:12:00Z", "days_to_auto_publish": 12, "flags": [], "escalated": false, "has_media": false, "comments": 0 }, { "review_id": "412873655", "status": "pending", "rating": 2, "title": "Arrived three weeks late", "product": { "name": "Trail Runner Shoe", "sku": "TR-100" }, "reviewer_name": "Sam O.", "submitted_at": "2026-10-14T16:40:00Z", "days_to_auto_publish": 5, "flags": [ "negative_sentiment" ], "escalated": false, "has_media": false, "comments": 0 } ], "next_cursor": null } ``` ### get_review One review with its full text, media, comments and history log. Access: read. REST: `GET /api/v1/yotpo/reviews/{review_id}`. MCP: `yotpo_read → get_review`. | Parameter | Type | Required | Description | |---|---|---|---| | `review_id` | string | yes | Review ID from list_reviews. | Returns the review as Manage Reviews shows it: star rating, title, full content, product, reviewer name and email, media, the replies posted on it and the history log of status changes. Use it before publish_review, hide_review or reply_to_review to read what the shopper actually wrote. A reply sent via email is not part of the public comments. Example response: ```json { "review_id": "412873651", "status": "published", "rating": 5, "title": "Grip that holds on wet trails", "content": "Ran two muddy 20 km loops in these and never slipped. Sizing is true.", "product": { "name": "Trail Runner Shoe", "sku": "TR-100" }, "reviewer": { "name": "Marta K.", "email": "marta.k@example.com" }, "media": [], "comments": [], "history": [ { "at": "2026-10-20T08:03:00Z", "event": "submitted" }, { "at": "2026-10-20T08:03:00Z", "event": "published" } ] } ``` ### list_questions Customer questions from Q&A with their status and answers. Pro, Premium and Enterprise plans. Access: read. REST: `GET /api/v1/yotpo/questions`. MCP: `yotpo_read → list_questions`. | Parameter | Type | Required | Description | |---|---|---|---| | `status` | enum | no | pending, answered, rejected or all. Default: pending. | | `product` | string | no | Product name, ID, UPC, MPN or SKU. | | `limit` | integer | no | Questions per call. | | `cursor` | string | no | Next page cursor from the previous call. | Lists the questions shoppers asked on product pages, the same ones Moderation shows under Q&A. status follows Yotpo's Sub Status filter: pending is a question nobody has answered. Each question carries the product, the asker and any answers with their visibility. Pass question_id to answer_question. Example response: ```json { "questions": [ { "question_id": "88120437", "status": "pending", "product": { "name": "Trail Runner Shoe", "sku": "TR-100" }, "asker_name": "Jon", "asked_at": "2026-10-22T11:30:00Z", "text": "Do these come in wide fit?", "answers": [] } ], "next_cursor": null } ``` ### get_publishing_settings The auto-publish rules in Settings > Publishing Settings: minimum rating and the profanity and sentiment filters. Access: read. REST: `GET /api/v1/yotpo/publishing-settings`. MCP: `yotpo_read → get_publishing_settings`. No parameters. Returns whether Auto-publish reviews is on, the minimum star rating below which you publish by hand, and the state of the negative-sentiment filter. The profanity filter always blocks auto-publishing; profanity_alerts says whether you get emails for it. Reviews held back publish by themselves after 14 days unless you act. Read it before judging a queue. Example response: ```json { "auto_publish": true, "minimum_star_rating": 3, "negative_sentiment_filter": true, "profanity_alerts": true, "held_review_auto_publish_days": 14 } ``` ### get_loyalty_customer A Yotpo Loyalty customer's status, tier, points balance, total earned and last activity, found by email. Access: read. REST: `GET /api/v1/yotpo/loyalty-customer`. MCP: `yotpo_read → get_loyalty_customer`. | Parameter | Type | Required | Description | |---|---|---|---| | `email` | string | yes | Customer email address, exactly as in Yotpo. | Opens the profile the Customers page shows for one email address: Member or Not Enrolled, tier, current points balance, total points earned and deducted, join date, total spend, last loyalty activity and tags. The email must match exactly, with no spaces. A customer who is Not Enrolled has no balance to adjust. Example response: ```json { "email": "ana.lopez@example.com", "status": "Member", "tier": "Silver", "points_balance": 90, "points_earned_total": 1020, "points_deducted_total": 930, "joined_at": "2025-03-14", "total_spend": 612.4, "last_loyalty_activity": "2026-10-19", "tags": [ "newsletter" ] } ``` ### list_customer_earnings Earning history of one loyalty customer: date, title, reward and points expiration. Access: read. REST: `GET /api/v1/yotpo/customer-earnings`. MCP: `yotpo_read → list_customer_earnings`. | Parameter | Type | Required | Description | |---|---|---|---| | `email` | string | yes | Customer email address, exactly as in Yotpo. | | `since` | date | no | Only earnings on or after this date. | Returns the Earnings table of a customer's profile: the date, the earning title, the reward and when the points expire. visible says whether the customer sees the row; manual adjustments are hidden by default. Use it to find which campaign or order added or removed points before you adjust them. Example response: ```json { "earnings": [ { "date": "2026-10-19", "title": "Placed an order", "reward": "60 points", "points_expiration": "2027-10-19", "visible": true }, { "date": "2026-10-12", "title": "Left a review", "reward": "30 points", "points_expiration": "2027-10-12", "visible": true } ] } ``` ### publish_review Make a pending or hidden review visible on your store. Access: write, asks the user first. REST: `POST /api/v1/yotpo/reviews/{review_id}/publish`. MCP: `yotpo_write → publish_review`. | Parameter | Type | Required | Description | |---|---|---|---| | `review_id` | string | yes | Review ID from list_reviews. | Clicks Publish on the review. The review then shows in the reviews widget on your product page, so shoppers see it. Photos and videos are approved the same way, one review at a time. The call returns the new status. By default you confirm each call; you can switch that off for this tool. Example response: ```json { "review_id": "412873702", "status": "published", "rating": 5, "product": { "name": "Trail Runner Shoe", "sku": "TR-100" }, "published_at": "2026-10-23T08:05:00Z" } ``` ### hide_review Remove a review from your store without deleting it. Access: write. REST: `POST /api/v1/yotpo/reviews/{review_id}/hide`. MCP: `yotpo_write → hide_review`. | Parameter | Type | Required | Description | |---|---|---|---| | `review_id` | string | yes | Review ID from list_reviews. | | `reason` | string | yes | A reason from Yotpo's Hide menu, for example Profanity / Inappropriate, Foreign language or Fake. | Clicks Hide and picks the reason. The review stays in Manage Reviews with status hidden and can be published again with publish_review. Yotpo does not notify the reviewer when a review is hidden, so this reaches no one and needs no confirmation. Example response: ```json { "review_id": "412873660", "status": "hidden", "reason": "Fake" } ``` ### escalate_review Mark a pending review as escalated so it is never auto-published. Access: write, asks the user first. REST: `POST /api/v1/yotpo/reviews/{review_id}/escalate`. MCP: `yotpo_write → escalate_review`. | Parameter | Type | Required | Description | |---|---|---|---| | `review_id` | string | yes | Review ID from list_reviews. | | `reason` | enum | yes | product_issues, shipping_issues, customer_service_needed, product_safety_alert or other. | | `note` | string | no | Free text, used with reason other. | Works only on reviews in the Pending state. An escalated review is never auto-published, and the Escalated badge stays on it after it is published or hidden, so it cannot be fully undone. By default you confirm each call; you can switch that off for this tool. Example response: ```json { "review_id": "412873655", "status": "pending", "escalated": true, "reason": "shipping_issues" } ``` ### reply_to_review Reply to a review, public on your store or privately by email. The reviewer is always emailed. Access: write, asks the user first. REST: `POST /api/v1/yotpo/reviews/{review_id}/replies`. MCP: `yotpo_write → reply_to_review`. | Parameter | Type | Required | Description | |---|---|---|---| | `review_id` | string | yes | Review ID from list_reviews. | | `body` | string | yes | Reply text. Links as [text](URL) with a full http or https address; some emoji are not supported. | | `visibility` | enum | no | public (default) or email. | A public reply shows beside the review on your site and is emailed to the reviewer. A reply via email reaches only the reviewer and cannot be edited or deleted afterwards. The call returns the review status after the reply. By default you confirm each call; you can switch that off for this tool. Example response: ```json { "review_id": "412873651", "visibility": "public", "body": "Thank you, Marta! Glad the grip held up on wet trails. Enjoy the miles.", "review_status": "published", "posted_at": "2026-10-23T08:20:00Z" } ``` ### answer_question Answer a customer question, public under the question or private by email. Pro, Premium and Enterprise plans. Access: write, asks the user first. REST: `POST /api/v1/yotpo/questions/{question_id}/replies`. MCP: `yotpo_write → answer_question`. | Parameter | Type | Required | Description | |---|---|---|---| | `question_id` | string | yes | Question ID from list_questions. | | `body` | string | yes | Answer text. | | `visibility` | enum | no | public (default) or private. | A public answer is published on your store under the question. A private answer is emailed to the shopper who asked. By default you confirm each call; you can switch that off for this tool. Example response: ```json { "question_id": "88120437", "visibility": "public", "status": "answered", "posted_at": "2026-10-23T08:25:00Z" } ``` ### resend_review_request Email the reviewer a new review request from the review's menu. Access: write, asks the user first. REST: `POST /api/v1/yotpo/reviews/{review_id}/request/resend`. MCP: `yotpo_write → resend_review_request`. | Parameter | Type | Required | Description | |---|---|---|---| | `review_id` | string | yes | Review ID from list_reviews. | Uses Re-send review request in the review's three-dot menu. The reviewer gets an email, so it reaches a person. By default you confirm each call; you can switch that off for this tool. Example response: ```json { "review_id": "412873660", "request": "sent", "sent_at": "2026-10-23T08:30:00Z" } ``` ### adjust_loyalty_points Add or deduct points on a loyalty customer's balance with a reason and a note. Access: write, asks the user first. REST: `POST /api/v1/yotpo/loyalty-points/adjust`. MCP: `yotpo_write → adjust_loyalty_points`. | Parameter | Type | Required | Description | |---|---|---|---| | `email` | string | yes | Customer email address, exactly as in Yotpo. | | `direction` | enum | yes | add or deduct. | | `points` | integer | yes | Number of points, a positive whole number. | | `reason` | enum | yes | Add: reward_customer or refund_points_deducted. Deduct: redeem_points_for_discount, remove_earned_points or manually_expire_points. | | `note` | string | yes | Explanation shown in the customer's Rewards History. | reward_customer and remove_earned_points change both the balance and total earned points, so they can move the customer's tier. The other reasons change the balance only. The call returns the balance, total earned and tier after the change. By default you confirm each call; you can switch that off for this tool. Example response: ```json { "email": "ana.lopez@example.com", "direction": "add", "points": 150, "reason": "refund_points_deducted", "points_balance": 240, "points_earned_total": 1020, "tier": "Silver" } ``` ## How do I connect Yotpo to Claude Code, Codex or Cursor? Connecting Yotpo takes three steps: sign up, sign in to Yotpo once in your Cloud Browser and enable it for agents, then add one MCP server or call the REST API with the same key. ### Connect Yotpo to your agent. 1. **Create an account** Sign up and add Yotpo in the console. Your API key is there too. 2. **Sign in to Yotpo in your Cloud Browser** Open your Cloud Browser in the console: your own Chrome in the cloud. Sign in to Yotpo there yourself, the way you always do, then press Enable for agents, read only or read and write. We never save your password, and your agent keeps working even when your computer is off. 3. **Add Cotlet to your agent** Paste the snippet for your client. The same server and key serve every app you connect, so you do this once. Claude Code: ``` claude mcp add --transport http cotlet \ https://cotlet.dev/mcp/v1 \ --header "Authorization: Bearer $COTLET_API_KEY" ``` Cursor: ``` { "mcpServers": { "cotlet": { "url": "https://cotlet.dev/mcp/v1", "headers": { "Authorization": "Bearer ${COTLET_API_KEY}" } } } } ``` Codex: ``` # ~/.codex/config.toml [mcp_servers.cotlet] url = "https://cotlet.dev/mcp/v1" bearer_token_env_var = "COTLET_API_KEY" ``` 4. **Ask your agent** Ask in plain words. Your agent finds the Yotpo tools on the server and calls them for you; anything that reaches other people waits for your OK unless you switch that off for a tool. ``` Go through the pending Yotpo reviews. Publish the ones that are genuine, escalate anything about product safety or shipping to me, and hide spam. Show me the reason for each. ``` ### Call Yotpo from your scripts. 1. **Export your API key** Your scripts use the same API key as your agent. Keep it in an environment variable, never in your code. ``` export COTLET_API_KEY="cotlet_..." ``` 2. **Call a tool** Every tool is an endpoint under /api/v1/yotpo with its own method and path, listed with the endpoints above. Path parameters go in the URL; the other parameters go in the query for GET and DELETE and in a JSON body otherwise. ``` curl -X POST https://cotlet.dev/api/v1/yotpo/reviews/412873651/replies \ -H "Authorization: Bearer $COTLET_API_KEY" \ -H "Content-Type: application/json" \ -d '{"body":"Thank you, Marta! Glad the grip held up on wet trails. Enjoy the miles.","visibility":"public"}' ``` 3. **Read the result** You get plain JSON back, ready for your script. A failed call costs nothing. ``` { "review_id": "412873651", "visibility": "public", "body": "Thank you, Marta! Glad the grip held up on wet trails. Enjoy the miles.", "review_status": "published", "posted_at": "2026-10-23T08:20:00Z" } ``` ## Why use Cotlet for Yotpo? **Built for agents** - One MCP server for every app you connect. - The same tools as a REST API for scripts and cron jobs. - Works with Claude Code, Codex and Cursor. **Your login stays yours** - You sign in to Yotpo yourself, in your own Cloud Browser. We never save your password; the profile is encrypted with AES-256-GCM, the cipher 1Password uses. - A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory. - The model never sees a login. - No stored passwords, no CAPTCHA solving, no MFA bypass. **You stay in control** - Scope each API key: its apps, its tools, read only or read and write. - Anything that reaches other people waits for your OK, so a leaked key cannot post or message as you. - Every background request listed in your Background activity. Disable for agents in one click. **Kept working for you** - We test every integration every 6 hours. - When Yotpo changes, the tool pauses until we fix it. - Failed calls cost nothing. ## Is it safe to connect Yotpo to Cotlet? Yes. You sign in to Yotpo yourself, in your own Cloud Browser, and we never save your password. Your agents only get Yotpo once you enable it, and every background request is listed. The browser profile is stored encrypted with AES-256-GCM, the same cipher 1Password uses for its vaults and Apple for iCloud Keychain. Independent public scanners grade cotlet.dev A+ and find it clean; click a result to rerun it yourself. - **A+ on Qualys SSL Labs**: Encryption in transit: TLS setup and certificates, on all four server addresses. [Live result](https://www.ssllabs.com/ssltest/analyze.html?d=cotlet.dev) - **A+ on securityheaders.com**: Browser protections sent with every page, all six headers present. [Live result](https://securityheaders.com/?q=cotlet.dev&followRedirects=on) - **A+ on Mozilla Observatory**: Mozilla's web security baseline: score 120 of 100, 12 of 12 tests passed. [Live result](https://developer.mozilla.org/en-US/observatory/analyze?host=cotlet.dev) - **Clean on Sucuri SiteCheck**: No malware, spam or defacement, and not on any of 9 blocklists, Google Safe Browsing included. [Live result](https://sitecheck.sucuri.net/results/cotlet.dev) [How Cotlet protects your access](https://cotlet.dev/security.md) ### Common concerns **Who runs Cotlet?** Cotlet is run by Take Group, a Polish software company working since 2019. Take Group runs about 3,200 websites on its own systems and has its own DevOps team for infrastructure security. We built and used integrations like this inside the company for years before opening them as Cotlet. **Is this an official Yotpo integration?** No, Cotlet is independent of Yotpo. Yotpo's own API is too limited for this work. Cotlet works through your own Yotpo account, the way you use Yotpo in the browser, so you need no partner approval and no developer setup. **What about client data and GDPR?** Cotlet is run from the EU and follows the GDPR. Cloud Browsers run in Finland, a Tier 1 country in the ITU Global Cybersecurity Index 2024. Data passes through a call and is not kept after it. **Can I start with read only?** Yes. Enable the app for agents as read only, or make the API key read only, and anything that reaches other people waits for your OK unless you switch that off per tool. **Is it reliable?** Every Cotlet service is checked every 3 minutes from Europe, North America, Asia and Australia. The live results and any outage are public at status.cotlet.dev. **How do I stop?** Press Disable for agents next to Yotpo in your console: your agents lose access at once and you stay signed in. Signing out of Yotpo in the browser works too, and Reset browser deletes the whole profile. ## Is there a Yotpo MCP server on GitHub? Yotpo's own API and its Discover MCP server are the official options. The API suits data sync at volume, and you write and host the code that turns it into agent tools. It has no way to publish, hide or reply to a review. Cotlet hosts a server that works in your Yotpo account for those jobs, and our team keeps it working. | | Yotpo API | Cotlet | |---|---|---| | Setup | Get the app key and secret from the account admin, request tokens, write and host your own tools | Sign up, sign in to Yotpo once, add one MCP server or API key | | When Yotpo changes | The API is documented and versioned; you keep your code current | Our team tests it daily and fixes it for you; failed calls are free | | Your credentials | App key and secret, plus a separate Loyalty API key and GUID, stored in your code or vault | Your sign-in session in your own Cloud Browser in the EU, profile encrypted; no key or secret from Yotpo | | When access expires | The token expires and you generate a new one | Your Cloud Browser keeps you signed in; if Yotpo logs you out, your agent gets a link to sign in again | | Review moderation and replies | Not in the UGC API reference; the official MCP does not cover it either | Publish, hide, escalate and reply from your agent | | Where it runs | Wherever you host it | Hosted: Claude Code, Codex, Cursor, n8n and scripts, also on a schedule | | Price | Your developer time | Free 7-day trial, then pay-as-you-go credit packs, no subscription | ### Which one fits you **Pick Cotlet if** - you are not a developer, or you do not want to maintain a server - you need it to keep working when Yotpo changes, without checking it yourself - your agent or a script should run it on a schedule, also while your computer is off **Pick an open-source server if** - you are comfortable installing, updating and fixing it yourself - you want your sign-in to stay on your own computer - you only need it now and then, from one MCP client ## How much does the Yotpo API cost? Free 7-day trial with 2,000 credits, no card needed. After that, the Yotpo API is pay as you go with no limit on apps: Credit packs from $29 for 5,000 credits, one-time, no subscription. A successful call uses 10 credits (about $0.04 to $0.06), your Cloud Browser uses 50 credits a day while it has an app enabled for agents, however many apps that is, and an agent driving the browser itself uses 5 credits a minute. Credit packs stay valid for 12 months and stack, so unused credits carry over. | Credits | Price, one time | Calls at 10 credits | Per 1,000 credits | |---|---|---|---| | 5,000 | $29 | 500 | $5.80 | | 15,000 | $79 | 1,500 | $5.27 | | 32,000 | $149 | 3,200 | $4.66 | | 60,000 | $249 | 6,000 | $4.15 | Only successful calls use credits; failed calls and timeouts cost nothing. At a balance of 0 calls pause, never a surprise charge. Authenticate with the `Authorization: Bearer` header. [See full pricing](https://cotlet.dev/pricing.md) ## How Cotlet holds your access Cotlet hosts MCP servers and REST APIs for apps with no usable API. Your agent works in your own Yotpo account. - **Company details:** Cotlet is run by Take Group sp. z o.o., a company registered in Poland. Its full address and registration numbers are in the Terms of service. [Terms of service](https://cotlet.dev/terms) - **Your sign-in:** You sign in to Yotpo yourself, in your own Cloud Browser: a Chrome we run for you in the EU, one per app. We never save your password (password saving is off), the profile is stored encrypted with AES-256-GCM, and your agents get Yotpo only after you enable it. When Yotpo signs you out, your agent gives you a link to sign in again. [Security](https://cotlet.dev/security.md) - **Revoking access:** Press Disable for agents next to Yotpo, sign out of Yotpo in your Cloud Browser, or reset the browser. Every background request is listed in your Background activity. Actions that reach other people wait for your OK unless you switch that off per tool. - **What we never do:** Store passwords, solve CAPTCHAs or bypass MFA. - **Yotpo's terms:** You use your own Yotpo account and stay responsible for following Yotpo's terms. Cotlet is independent and not affiliated with Yotpo. [Terms](https://cotlet.dev/terms) - **Contact:** Questions about the company, security or an app: [contact@cotlet.dev](mailto:contact@cotlet.dev) ## Frequently asked questions **How do I get access?** Sign up free, open Yotpo in the console and press Request access. Then you create your API key and connect Yotpo there. **Do I need to be technical?** No. You sign in to Yotpo once in your Cloud Browser, a normal Chrome you open from the console, and paste one command into your agent, or one URL into n8n. Your agent can walk you through it. There is no server to install, update or fix. **Is it safe to connect Yotpo to Cotlet?** Yes. You sign in to Yotpo yourself, in your own Cloud Browser in the EU, and we never save your password. Your agents only get Yotpo once you enable it, every background request is listed, and the browser profile is stored encrypted with AES-256-GCM, the cipher 1Password uses for its vaults. The AI model never sees a login, posts and messages wait for your OK, and Disable for agents cuts access in one click. Independent scanners grade cotlet.dev A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory; live results are on https://cotlet.dev/security. **Is a hosted server safer than a local one? My Yotpo sign-in would leave my computer.** On Cotlet you sign in inside your own Cloud Browser, which only you open, and its profile is stored encrypted with AES-256-GCM in the EU. Agents get only the apps you enable, and every background request is listed. A local server keeps your Yotpo cookie in a plain file on your computer, readable by any program you run, and stops when your computer is off. **Why does Cotlet send requests instead of clicking in my browser?** To be fast, Cotlet doesn't click through Yotpo's pages. It sends the same requests your browser would, from your browser's IP with its cookies, without opening a window. Yotpo sees the same browser and IP you signed in with, and every request is listed in your Background activity. **What if someone gets my Cotlet API key?** The key holds no Yotpo login or cookies, it only asks Cotlet to run a tool. It can call only the apps and tools you gave it, and a read-only key changes nothing. Anything that reaches other people, like posts, comments or messages, waits for your OK in the dashboard by default, so a leaked key cannot post or message as you. When you switch approval off for a scheduled job, give that job its own key limited to that one tool. Every call is in your activity log, and deleting the key ends access at once. **Why a signed-in browser and not OAuth, like other integration platforms?** Yotpo offers no OAuth token you can simply grant for these tools: its official API leaves them out or needs a developer app, a plan or an approval first (see the official API section above). That is why Cotlet sets the limits itself: per key, per tool, with your approval before anything reaches other people. Cotlet is run by Take Group sp. z o.o., an EU company (VAT PL6342984273). **Which Yotpo plan do I need?** Cotlet works in your own Yotpo account, so the plan decides what the screens offer. Manage Reviews and replies are on the Free, Starter, Pro, Premium and Enterprise plans, adjusting a customer's points on Free, Pro, Premium and Enterprise, and Q&A moderation on Pro, Premium and Enterprise. A tool for a screen your plan lacks fails. **Do I need my Yotpo app key and secret?** No. Cotlet works from your signed-in session, not the API. Yotpo shows the secret key only to the account administrator, and Loyalty has its own API key and GUID, so a teammate without that role could not use the API at all. **Can my agent post or send messages in Yotpo without asking me?** No. Every call to publish_review, escalate_review, reply_to_review, answer_question, resend_review_request or adjust_loyalty_points waits for your OK by default. For scheduled automations you can switch confirmation off per tool in your dashboard, for example only for approvals. hide_review runs without asking, because it sends nothing to anyone and one call undoes it. **Can I use the Yotpo API in n8n?** Yes. Add https://cotlet.dev/mcp/v1 with your API key in n8n's MCP Client node, or call its endpoints under https://cotlet.dev/api/v1/yotpo from the HTTP Request node. --- Give your AI agents your signed-in browser. **Product:** [Integrations](https://cotlet.dev/integrations.md) · [Use cases](https://cotlet.dev/use-cases.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Pricing](https://cotlet.dev/pricing.md) · [Security](https://cotlet.dev/security.md) **Resources:** [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [GitHub](https://github.com/cotletdev/cotlet) **Solutions:** [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md) **Company:** [About](https://cotlet.dev/about.md) · [AI info: company facts](https://cotlet.dev/ai-info.md) · [Contact](https://cotlet.dev/contact.md) **Legal:** [Terms of service](https://cotlet.dev/terms) · [Privacy policy](https://cotlet.dev/privacy) · [Refund policy](https://cotlet.dev/refunds) · [Acceptable use](https://cotlet.dev/acceptable-use) · [Cookie policy](https://cotlet.dev/cookies) · [DPA](https://cotlet.dev/dpa) · [Subprocessors](https://cotlet.dev/subprocessors) **Elsewhere:** [Status page](https://status.cotlet.dev) · [Cotlet on GitHub](https://github.com/cotletdev) · [Cotlet on X](https://x.com/cotletdev) · [Cotlet on LinkedIn](https://www.linkedin.com/company/cotletdev) · [Cotlet on Product Hunt](https://www.producthunt.com/products/cotlet) · [Cotlet on Crunchbase](https://www.crunchbase.com/organization/cotlet) · [Cotlet on SaaSHub](https://www.saashub.com/cotlet) Cotlet.dev is built by Bart Krawczyk and Jake Slugocki, the founders of Take Group sp. z o.o., ul. Wincentego Janasa 4, 40-855 Katowice, Poland. KRS 0000871398, NIP 6342984273, VAT EU: PL6342984273. [About us](https://cotlet.dev/about.md) Cotlet is an independent service. It is not affiliated with, endorsed by or sponsored by any of the products listed on this site. Product names are trademarks of their respective owners.