Which Shopify Review Apps Let an AI Support Agent Find, Reply to and Moderate Reviews? Judge.me, Okendo, Fera and 8 More (2026)

Which Shopify review apps can an AI agent reach, and with what key?

Ratings and review counts come from each app's Shopify App Store listing on 28 September 2026 (REVIEWS.io's from 25 September). The API columns come from each vendor's API reference the same day. "Static key" means the merchant creates a key once and the agent sends it on every call, with no login and no token that expires. None of these apps has a built-in Macha connector; the route column says what's possible through a custom API tool.

Add it up: six apps have a documented support write reachable with a static key (Judge.me, Stamped, Fera, Okendo, Klaviyo Reviews, REVIEWS.io), two we couldn't verify (Loox, Junip), and three aren't feasible for support writes today (Yotpo Reviews, AG Product Reviews, Trustpilot). Six plus two plus three is 11.

The App Store counts need one caveat. Judge.me's 47,594 reviews are about five times Loox's 9,694, but review counts measure how many merchants rated the app, not how many support tickets it generates. Trustpilot's 18 are there because most of its customers aren't on Shopify at all; on the Zendesk Marketplace its Trustpilot Reviews app had 841 installs when we checked on 25 September.

What do customers ask about reviews?

Review tickets are a small share of a store's queue, but they're awkward, because a review sits between the shopper, the store and every future shopper who reads it. The requests fall into five shapes:

1. "Please take my review down" or "change it to five stars." Usually the problem got fixed after the shopper posted. This is the most common one and the one an agent should never do on its own.
2. "My review isn't showing." The review is waiting for moderation, was declined, or never arrived. An agent that can read the review's status can answer this.
3. "Where's my discount for leaving a review?" Photo-review coupons and loyalty points for reviewing are common. The agent needs the review and the reward record.
4. "Stop sending me review request emails." An unsubscribe from the review app's own emails, which is separate from marketing email.
5. "Another customer's review is wrong or offensive." A moderation report about someone else's words.

Shoppers also use reviews before they buy. Talkdesk's post-holiday survey found that 61% of shoppers had used AI to find product reviews (n=1,000, January 2026). That's a pre-purchase job for the store's chat, and review display APIs such as Junip's are built for it. This page is about the post-purchase tickets.

Which jobs can an AI agent finish end to end?

Very few of them, and that's mostly by design. The lookup is where the API work goes.

Finding the review. The customer gives you an email and maybe a product name. Here's how each API handles that:

• Fera filters reviews by customer.email directly, and each review comes back with a state: pending_approval, pending_update, approved, declined_approval or pending. One call answers "is my review showing?"
• Judge.me lists reviews by reviewer_id, not email. Its reference says to look up a record by another field by setting the ID to -1, so the agent calls GET /reviewers/-1?email= first, takes the reviewer's Judge.me ID, then calls GET /reviews?reviewer_id=. Two tools, one after the other.
• Okendo can look up a customer's ID by email, but its List Reviews endpoint filters only by moderation status and sorts by date or rating, up to 100 a page. Finding one shopper's review means paging through recent reviews and matching name, product and date, at Okendo's limit of 2 requests a second.
• Klaviyo Reviews filters by review ID, product, rating, status, date and a content search, but not by email.
• REVIEWS.io finds store reviews by order number, which suits a ticket that quotes one, but that lookup needs the private apikey, and the reference we link is marked deprecated in REVIEWS.io's own spec, so confirm the current endpoint before building the tool.
• Stamped's legacy Get Reviews marks an email query parameter as required without describing it. Test it against a real store before you rely on it as a reviewer filter.

We found one of these the hard way. An earlier review tool on our test account called Judge.me with a reviewer_email parameter on /reviews. Judge.me's OpenAPI file doesn't list that parameter; the documented filters are reviewer_id, product_id and rating. With a dummy key, Judge.me returns the same authentication error either way, so a placeholder test can't catch an undocumented filter. Build from the reference, then test with the merchant's real key before the agent goes live.

Answering from what the lookup returns. Once the agent has the review, "is it showing?" and "did it go through?" are reads the agent can finish: pending means waiting for moderation, approved means it's live. A reward question can be finished too, if the reward lives in a loyalty app the agent can also read; the Smile.io page covers that side.

Writes the agent could make. Judge.me's PUT /reviews/{id} publishes or hides a review with curated set to ok or spam. Okendo's PUT /enterprise/reviews/:reviewId sets the moderation status and POST .../reply posts a reply, with an option to email it to the customer. Fera documents approve, decline, update and delete. Klaviyo's Update Review sets the status to published, unpublished, featured, pending or rejected, and a rejection needs one of six reasons, from fake to other. REVIEWS.io's writes are about invitations: queue one, edit one, or unsubscribe an address from invitation emails, which covers request type 4 above.

Which review apps can't an agent reach with a static key?

Four kinds of wall stop an agent here.

An expiring token. Yotpo's reviews API issues an access token generated from the store's secret, and its authentication page says to generate a new one when a call returns 401. A custom tool with a fixed header can't do that refresh. Yotpo's loyalty API is a separate product with a static GUID and key; the Yotpo page splits the two.

OAuth for private data. Trustpilot's public reviews work with an API key in an apikey header. Anything private, including replying to a review, needs OAuth, where access tokens expire after 100 hours and refresh tokens after 30 days, per Trustpilot's authentication page. An agent can read public Trustpilot reviews but can't reply through a static-key tool.

No public reference. We found no public API reference for AG Product Reviews, by Avada, which has 3,158 App Store reviews. Loox's developer site returned a Cloudflare 525 error on 28 September, so we couldn't read what its API covers, and Junip's API docs ask for a password. For those three, a build starts with asking the vendor for its API reference.

A reference that says "coming soon." Stamped's current Reviews APIs page, last updated 16 September 2025, says its new review APIs are "coming soon" and points to the legacy v2.0 reference. The legacy endpoints work with the stamped-api-key header, so we count Stamped as reachable, but a build on a legacy API should expect a migration.

Which review apps put the API behind a plan?

API access is cheap for a vendor to serve and valuable to a merchant automating support, so the vendor's incentive is to sell it as an upsell one tier up. Three of the 11 do that:

• Okendo: its reference calls the Merchant API the "Okendo Enterprise API," "available to enterprise customers," with HTTP Basic auth, 2 requests a second and an okendo-api-version header set to 2025-02-01.
• Loox: the App Store listing puts "Integrations, API access, and webhooks" on Convert at $49.99 a month, which includes 300 orders plus $50 per extra 300. Beginner, the free plan, doesn't list it.
• Junip: the listing puts "API & Custom Apps" on Premium at $299 a month, and its help center says display API access is "restricted to Premium merchants."

Judge.me's help center puts its Gorgias integration on the Awesome plan, $15 a month on the App Store listing, but its API reference doesn't state a plan for the private key.

What does the help desk's own integration already do?

For the two biggest apps, the help desk integration already does the moderation job a person needs, and it's worth checking before you build anything.

• Judge.me with Gorgias creates a Gorgias ticket for every new review under a star threshold you choose, for example 3 stars and below, and adds macros that publish or hide the review and send a public or private reply from the ticket. Judge.me's help center lists it on the Awesome plan.
• Yotpo with Gorgias shows reviews and loyalty data in the ticket sidebar and lets an agent reply to reviews and turn them into tickets, on Yotpo's Premium or Enterprise plans; our Yotpo and Gorgias setup guide walks through it.
• Okendo, Stamped, Fera, Junip and REVIEWS.io also list Gorgias integrations, and Loox and Okendo come up in our TikTok Shop and Gorgias guide. The Gorgias integrations roundup covers the wider catalog.
• On Zendesk, Trustpilot's Reviews app had 841 installs and REVIEWS.io's app 86 when we checked the Marketplace on 25 September.

These integrations put the review in front of a human agent, and the macro does the moderation. They don't answer the shopper's ticket for you. That's the gap an AI agent fills: reading the review's status, answering "is it showing?", and writing the handoff note so the person with the macro has everything in one place. The help desk AI actions matrix compares what each desk's native AI can do in Shopify.

Our test: a review agent on two sandbox tickets

We built four read-only custom tools on Macha's test account on 28 September 2026, one per auth shape: Fera (Secret-Key header), Judge.me (X-Api-Token plus shop_domain), Okendo (an Authorization: Basic header plus a fixed okendo-api-version header) and REVIEWS.io (store and key in the query string). Each got a placeholder key, and we pressed each tool's Run Test button. All four reached the vendor's live API and got HTTP 401, which proves the request shape and header names reach the vendor, and nothing more:

REVIEWS.io's error is the most useful: it names the store parameter, because our store ID was made up. Judge.me's message doesn't say whether the key or the shop domain is wrong, so check both.

Then we created an agent, "T4-133-Review request triage (Fera)," with Zendesk's get ticket, public reply, internal note and tags tools plus the Fera lookup, and these instructions, pasted verbatim:

You handle tickets about product reviews for our store. Our review app is Fera.

1. Read the ticket and work out what the customer wants: remove or change their review, find out why it isn't showing, ask about a reward promised for reviewing, or complain about someone else's review.
2. Look up the customer's reviews with "T4-133 Fera: Find reviews by customer email", using the requester's email. Match the review by product and date. If you find none, or more than one that could fit, ask the customer which product and when they reviewed it.
3. You never publish, hide, edit or delete a review, and you never reply to a review. For a removal or change request, reply that a teammate will take care of it today, add an internal note with the review ID, rating, product, the state the tool returned and what the customer asked for, and tag the ticket reviews_handoff.
4. If a review isn't showing and the tool says its state is pending, tell the customer it's waiting for moderation. If it says declined, don't give a reason yourself: hand off as in step 3.
5. If the ticket mentions a product fault, an injury or allergic reaction, or a legal threat, send only a short holding reply, add an internal note and tag the ticket reviews_urgent.
6. If a review tool returns an error, don't tell the customer what went wrong inside our systems. Reply that a teammate is checking and will follow up today, add an internal note with the tool name, the HTTP status and the error message, and tag the ticket app_tool_error.

Never paste the customer's address or phone number into a note.

We ran it with Macha's agent Test feature, which creates a real ticket in our d3v-macha sandbox Zendesk and runs the agent the way a new-ticket trigger would. Both customers were made up.

Ticket #1141, "Can you take my review down?" Dana left a 2-star review on a linen throw because it arrived late, the team fixed it, and she wanted the review removed "or changed to 5 stars." The agent called the Fera tool twice, got 401 both times, and 9 seconds after the ticket was created posted a public reply: "A teammate is checking this for you and will follow up today." Its internal note named the tool, the 401 and Fera's message, and recorded that she wanted her Linen Throw Blanket review removed or changed. It tagged the ticket app_tool_error. It didn't claim to have done anything, and it had no tool that could.

Ticket #1142, "My review isn't showing." Tomas asked why his photo review of a mug wasn't on the product page. Same pattern: two 401s, a holding reply 9 seconds after creation, a note with the error and his email, and the app_tool_error tag. With a real key, this is the ticket the agent could have closed by reading the review's state.

Two things we'd change after reading the runs. On #1141 the agent tagged only app_tool_error, not reviews_handoff, so a team that routes removal requests by tag would miss it; the instructions should say to add both tags when a lookup fails on a removal request. And each run used two Fera calls for one lookup, because the agent retried once after the 401. That's harmless on a read, but it's why the instructions should never give a review agent a Write tool without saying exactly when to call it: in a 28 September test, a custom Write tool on our account ran in dashboard chat with no confirmation card.

We didn't see a successful call to any review app. We hold no merchant keys, so every result above is a 401 from the vendor's live API.

What must stay with a person?

More than in most categories, because the rules sit outside the API.

• Removing or changing a review. The FTC's final rule on consumer reviews, announced 14 August 2024, bars a business from misrepresenting that the reviews on its site represent all or most of those submitted "when reviews have been suppressed based upon their ratings or negative sentiment," and from using threats or intimidation to remove a negative review (FTC announcement). A shopper asking to take down her own review is her choice, but the agent should hand it to a person who can confirm it's hers and record the request, not hide it on the strength of an email.
• Rewards tied to a rating. The same rule prohibits incentives "conditioned on the writing of consumer reviews expressing a particular sentiment." An agent should never offer a discount in exchange for changing a 2-star review, and "change it to 5 stars" requests go to a person.
• Editing the words. Judge.me's reference says it doesn't support editing reviews via API "for authenticity reason," and Klaviyo's Update Review changes status only. Even where an API allows content updates, as Fera's does, the shopper's words should stay the shopper's.
• Reviews that report harm. A review describing an injury, a reaction or a defect is a product-safety signal first. Route it to a person, as step 5 of our instructions does.
• Moderation reports about other people's reviews. Deciding whether someone else's review is fake or abusive is a judgment call with legal weight. Klaviyo's rejection reasons (fake, false_or_misleading, private_information and so on) are a good checklist for the person who makes it.

Where Macha fits

No review app on this page has a built-in Macha connector. Each connects through a custom API tool that Macha's team sets up during onboarding, with the app's own auth: a header key for Judge.me, Fera and Stamped, Basic auth plus a version header for Okendo, two headers for Klaviyo, or the key in the URL for REVIEWS.io. Custom tools can send fixed headers on every call, which is what Okendo's and Klaviyo's version headers need, and each tool has a Run Test button that shows the vendor's raw response, as in the screenshot above. Custom tools and that setup work are included on every plan. Macha's built-in Shopify connector adds the order side, so an agent can confirm a reviewer actually bought the product before a person acts on a removal request.

We'd build review lookups as Read tools and keep moderation with your team, using the help desk macro or the review app's own dashboard. If you want an agent to publish or hide reviews, Judge.me, Okendo, Fera and Klaviyo document the calls, but the instructions have to say exactly when, since custom Write tools can run without a confirmation step.

Macha is charged per ticket, starting at $299/month for 750 tickets, so a review ticket with two lookups, a reply and a note is one charge; the full ladder is $299 a month for 750 tickets, $599 for 1,500, $1,199 for 3,000, $1,999 for 5,000, $2,999 for 7,500 and $3,999 for 10,000, with custom pricing above that. It fits teams running Zendesk, Freshdesk, Gorgias, Front, HubSpot or Intercom on a Shopify store with Judge.me, Okendo, Fera or Stamped who want review questions answered from the review's actual status. You can try it on $50 of free usage (about 125 tickets), no credit card, no time limit.

The rest of the Shopify app map is on which Shopify apps an AI support agent can work with. The Judge.me page goes deeper on Judge.me's reply endpoints, and the Klaviyo page covers the consent side of Klaviyo.

FAQ

Which Shopify review apps have an API an AI support agent can use?

As of 28 September 2026, Judge.me, Fera, Stamped, Okendo, Klaviyo Reviews and REVIEWS.io document support actions in an API that takes a static key. Okendo's is for Enterprise customers. Loox and Junip have APIs on paid plans whose references we couldn't read, and Yotpo Reviews and Trustpilot need tokens that expire.

Can an AI agent find a customer's review from their email address?

In one call only with Fera, whose List Reviews endpoint filters by customer.email. Judge.me needs two calls: find the reviewer by email, then list reviews by reviewer ID. Okendo and Klaviyo Reviews have no email filter on their review lists, and REVIEWS.io finds store reviews by order number.

Can an AI agent delete or hide a customer's review?

Several APIs allow it: Judge.me publishes or hides, Fera approves, declines or deletes, and Okendo and Klaviyo change a review's status. We'd keep it with a person. The FTC's 2024 rule bars presenting reviews as complete when some were suppressed for their rating or sentiment, and a removal request should be confirmed as the reviewer's own before anyone acts.

Can an AI agent reply to a Judge.me or Okendo review?

The APIs document it: Judge.me's POST /replies posts a public reply on the review widget and POST /private_replies emails the reviewer, and Okendo's reply endpoint can email the customer too. Both work with a static credential. Whether an agent should post public replies unsupervised is a brand decision, so most teams start with drafts for a person.

Why can't an AI agent reply to Trustpilot reviews with an API key?

Trustpilot's API key covers public data only. Replying to a review is a private API, which needs OAuth 2.0; access tokens expire after 100 hours and refresh tokens after 30 days, so a custom tool with a fixed key can't keep them current.

Does Gorgias already handle review tickets?

For Judge.me and Yotpo, largely. Judge.me's Gorgias integration creates a ticket for reviews under a star threshold and adds macros to publish, hide and reply, on Judge.me's Awesome plan. Yotpo's shows reviews in the sidebar and lets agents reply on Premium or Enterprise. Both put the decision in front of a person rather than answering the shopper.

How we researched this

• App Store figures come from each app's Shopify App Store listing, read from the listing's structured data on 28 September 2026: Judge.me 5.0 from 47,594 reviews, Loox 4.9 from 9,694, Yotpo Product Reviews 4.8 from 4,627, Stamped Reviews & Loyalty 4.7 from 3,752, AG Product Reviews 5.0 from 3,158, Fera 4.8 from 2,023, Okendo 4.8 from 1,426, Junip 4.8 from 1,156, Klaviyo 4.7 from 3,329 and Trustpilot 2.7 from 18. REVIEWS.io's 4.7 from 764 is from 25 September, because we couldn't find its listing URL on the 28th. Zendesk install counts are from the Zendesk Marketplace on 25 September. Plan prices are the App Store listings' monthly prices on 28 September.
• API facts come from each vendor's reference, fetched 28 September 2026: Judge.me's OpenAPI file (reviews, reviewers, replies and private replies), Fera authentication and List Reviews, Okendo's Merchant API usage page and List Reviews, Stamped's v2.0 getting-started page and Reviews APIs page, Klaviyo Update Review and Get Reviews, REVIEWS.io's reference, Trustpilot authentication and Yotpo authentication. Okendo's pages render only in a browser, so we read them in a headless one. Loox's developer site returned HTTP 525 and Junip's API docs asked for a password. Gorgias behavior comes from Judge.me's help center and Yotpo's Gorgias integration guide.
• "Six of 11" counts apps with at least one documented support write reachable with a static key. "Not feasible today" means an expiring token, OAuth for the job, or no public reference we could find on 28 September; it isn't a claim that no API exists.
• Arithmetic: 6 + 2 + 3 = 11 apps. 47,594 ÷ 9,694 ≈ 4.9, "about five times."
• Live test: on 28 September 2026 we created four custom tools and one agent on Macha's test account and ran two tickets (#1141 and #1142) in our d3v-macha sandbox Zendesk with Macha's agent Test feature, which posts the customer's message as an internal comment and marks the ticket "Via API." Requesters, products and reviews were made up, and every tool used a placeholder key, so each call reached the vendor's live API and got a 401. No merchant account was touched and no vendor returned real data.
• Vendor self-reports: Talkdesk's 61% is a survey by a company that sells contact-center AI.
• Examples are synthetic. No customer data was used. Macha facts come from our integrations page, custom tools docs and pricing.