Google Reviews API: limits and easier alternatives

Two different Google API routes

People often say “Google Reviews API” as if it were one product. For a public place listing, the relevant route is usually Places API (New), especially Place Details (New). It can return a business rating and a small sample of reviews. For reviews on a location that you own or manage, use the Google Business Profile APIs. They offer a paginated reviews list (one page at a time). They need profile permissions, project approval, and OAuth (Google's sign-in and permission step). The two routes solve different problems; a Places key does not unlock the Business Profile review list.

If your goal is simply to show real reviews on your own website, building a custom data pipeline may be more work than the display needs. You would have to handle credentials, billing, refreshes, attribution, data storage rules, responsive cards, failures, and policy changes. A saved widget can cover the website display while you focus on the page itself. If you are building a custom business-management product or data workflow, the direct APIs may be appropriate.

Places API: a maximum of five reviews

Google's current Places API resource reference says the reviews[] field returns at most five reviews, sorted by relevance. It is a sample, not a paginated feed of every review on the listing. A business can have many more Google reviews than a single Place Details response provides. Requesting the field again is not a way to page through the full collection.

Place Details (New) needs a place ID, a Google Maps Platform project, an enabled API, and billing. It also requires a field mask (the exact list of fields you want back). The example below requests a name, rating, rating count, and reviews. Replace both placeholders before trying it, and call it from a server or another protected environment. A server-side key must never be pasted into a public webpage or client-side JavaScript bundle.

curl -H "X-Goog-Api-Key: YOUR_SERVER_SIDE_API_KEY" \
  -H "X-Goog-FieldMask: displayName,rating,userRatingCount,reviews" \
  "https://places.googleapis.com/v1/places/YOUR_PLACE_ID"

Google's field list places reviews in the Place Details Enterprise + Atmosphere billing tier. The fields you request affect the bill, so avoid a wildcard mask in production. In October 2026, Google's price list showed 1,000 free calls a month for this tier, then $25 per 1,000 calls (up to 100,000). Check the current prices for your account. Asking only for rating is a different data request and does not give you review text. The returned sample can also vary with relevance and availability; do not promise that it contains the newest or your five favorite reviews.

Displaying the result takes more than printing review.text. Google's Places attribution policy requires Google Maps attribution when Places content appears without a Google map. It also requires author credit for reviews and access to the source content on Google Maps where available. Each review comes with the author's name, photo and profile link; at minimum, show the photo. You must also tell visitors how the reviews are ordered and filtered, and let them open each review on Google Maps. The policy also limits caching and storage. Only the place ID may be stored with no time limit. Build those rules into your design before you store or display API responses.

Business Profile API: managed locations only

The Business Profile reviews endpoint serves a different case: an account with access to a verified business location. Google's reviews.list reference returns pages of reviews for that location, with a maximum page size of 50 and a nextPageToken for later pages. It can support an owner's or authorized manager's review workflow. It cannot be used to pull every competitor's reviews just because their listings are public.

Before calls work, Google says you need a Cloud project and Business Profile API access approval. To apply, you must manage a Business Profile that has been verified and active for at least 60 days, and the business needs a website. Google says a quota of 0 queries per minute means the project is not approved yet, and 300 means it is. The authorized Google account must have access to the location. OAuth is also needed, using the business.manage scope. The request shape below is useful once your project has approval, your account is authorized, and you know the account and location IDs. Replace every placeholder with your own values; the access token is a secret and belongs on your server.

curl -H "Authorization: Bearer YOUR_OAUTH_ACCESS_TOKEN" \
  "https://mybusiness.googleapis.com/v4/accounts/YOUR_ACCOUNT_ID/locations/YOUR_LOCATION_ID/reviews?pageSize=50"

If the response contains a nextPageToken, pass it as pageToken on another request to continue. Unlike the Places sample, this list is sorted newest first by default (updateTime desc). The response also gives the averageRating and totalReviewCount. The maximum of 50 is a page size, not a cap on the account's total available reviews. Google's Business Profile API FAQ makes another distinction clear: approval is granted to a project, but it does not grant access to unrelated business profiles. Someone with the proper owner or manager permissions must authorize access to each relevant profile. Quotas and eligibility can change, so review Google's current documentation before planning a production integration.

Which option fits your task?

Use Place Details when you need limited public place information and can work within its small review sample, billing tier, and attribution rules. Use the Business Profile APIs when you manage the business's verified location and need a custom review-management workflow with authorization and pagination. For a visitor-facing review area on a site, a widget can be simpler than either direct integration: connect the business, choose a display, and copy one embed tag.

VerifiedWidget lets a business connect by pasting its Google Maps link. You can choose a grid, carousel, badge, list, and other layouts, then adjust appearance and which reviews appear. Its Free plan includes one widget, up to 20 reviews, a monthly refresh, and 10,000 views per month; paid plans add automatic syncing and more capacity. Check current plan details before deciding. A widget is still a live outside script, so test it against your site's security policy, allowed domains, and layout.

The dashboard's installation line looks like this. The ID is a placeholder and will not show a real business. Copy your own saved widget's code from the dashboard:

<script src="https://verifiedwidget.com/widget.js" data-widget-id="c123456789012345678901234" crossorigin="anonymous" async></script>

Paste it where reviews should appear on a plain HTML page, or follow the React or Next.js guides for component-based sites. The widget handles the visual display; the direct Google API routes remain useful when you need your own data processing and have the permissions to do it. Neither route guarantees search rankings or review stars. Google's self-serving review rule limits star results for a business's reviews on its own site; see our review-star guide.

Troubleshooting direct API requests

If Place Details responds with a field-mask error, make sure the X-Goog-FieldMask header is present and uses the New API's field names. If reviews are absent, check whether the place has reviews, whether you requested reviews rather than only rating, and whether the correct place ID was used. A request for all fields may create a higher bill than expected. Check the Google Cloud billing report and the SKU (the billing item) shown for the call. Places lookups do not all cost the same.

If a Business Profile review request returns a permission error, check five things. Is the project approved? Is the API enabled? Did you request the OAuth scope? Is the token from the right Google account? Does that account have access to the verified location? A valid API project alone is not enough. If only one page of reviews appears, follow nextPageToken. If a website widget is blank instead, check its saved reviews, widget ID, domain allowlist, monthly allowance, and browser console. Those are separate checks from Google Cloud API credentials.