Firm tokens
A firm token is a personal access token that belongs to your firm. The API is designed for business users who need access to private resources, and every request must carry a token generated from your Admin Dashboard.
--header 'Authorization: Bearer {access_token}'Building an integration for many firms, such as a case management system? Use a partner API token instead: one token for every firm you serve.
Generate an access token
Open API Settings
Go to your Admin Dashboard and click API Settings in the sidebar menu. You need a company admin account.
The Personal Access Token tab lists every token that can currently reach the ReviewSolicitors API, with its reference, value and expiry. Click Generate new token.
Name the token and set an expiry
In the Generate new token window, fill in:
| Field | What to enter |
|---|---|
| Reference | What the token is for, so you can recognise it later. For example Case management integration. Each token needs a different reference. |
| Expiry | How long the token stays valid: 7, 30, 60 or 90 days, a custom date, or No expiry. The window shows the exact date it will stop working. |
| What is this token for? | Choose API access, then the areas of the API the token can use. Give it only what the system using it needs. WordPress plugin is only for connecting the ReviewSolicitors WordPress plugin. |
Copy the token
Click Generate. The new token appears at the top of the list. Use the Copy action on its row to copy the value, then store it somewhere safe.
The token value stays listed on this page, so you can come back and copy it again later. From the same row you can Edit the reference, the expiry or what the token can do, or Revoke the token.
Treat the token like a password. It is scoped to your whole firm, not to you personally, and anyone holding it can read your firm’s reviews, send review requests and act on Client Assist enquiries on its behalf. Store it in an environment variable or secret manager, never in client-side code or a public repository. Because it stays readable in API Settings, revoke tokens you no longer use.
Using the token
Send the token as a Bearer token in the Authorization header.
cURL
curl --location 'https://www.reviewsolicitors.co.uk/api/v2/reviews' \
--header 'Authorization: Bearer {access_token}'Token expiry
You choose an expiry when you generate a token, and you can change it later with Edit on the token’s row. A token works up to and including its expiry date; after that, requests using it are refused with 401 and you need to extend it or generate a replacement. Choosing No expiry creates a token that never expires.
The token list flags tokens that expire within the next 7 days, but set a calendar reminder too so an integration does not stop without warning.
Permissions
A request to an area the token was not given is refused with 403 and a
message naming the missing permission, for example This token does not have the REVIEWS_LIST scope.
Tokens generated before permissions were introduced keep full access until you edit them.
Tokens also depend on your firm’s membership. While the firm is not on an active premium
membership, every request is refused with 403 and the message
API access is only available to active premium firms.