Applying for Google API access

This page exists because it is the most predictable source of confusion in this category. Read the box below first; it may save you two weeks of waiting for something you do not need.

Google integration works in three levels

Everything in Proofloop works without any Google credentials — including sending review requests and deep-linking customers to your Google review form. Adding a Places API key (instant) displays your rating and the 5 most recent reviews Google exposes publicly. Full review history, new-review notifications and replying from the dashboard require Google Business Profile API access, which you apply for directly from Google — approval typically takes around two weeks and is granted at Google’s discretion. Proofloop guides you through the application, but we cannot grant it.

You do not need any of this to use Proofloop

Review requests, collection pages, QR and NFC codes, the routing engine, text and video testimonials, moderation, the Wall of Love widget, social image export, multi-client agency accounts, PDF reports, and deep links that put a customer directly into your Google review form — all of that works today with no Google credentials whatsoever. If you never read past this paragraph, Proofloop still does its job.

Two different Google APIs

Google has two review-related APIs and they could hardly be less alike. Almost every support question about “the Google API” is really a confusion between these two columns.

	Places API	Business Profile API
How you get it	Create an API key. Instant.	Apply for Basic API Access per Google Cloud project.
Approval	None needed	Google reviews it, typically around 14 days. Applications are refused regularly.
Prerequisites	None	A verified, active Google Business Profile, normally at least 60 days old, plus a real business website and a specific use case.
Quota before approval	—	0 queries per minute. Every call fails until you are approved.
Quota after approval	Standard Maps quota	300 queries per minute
Which businesses	Any business on Google	Only locations your account owns or manages
How many reviews	Five. That is Google’s limit, not ours.	All of them
Reply to reviews	No	Yes
New-review notifications	No	Yes, via sync

The five-review limit is Google’s, and it applies to everyone

The Places API has returned a maximum of five reviews for a decade. Every product in this category that uses it has the same ceiling — if you have read a listing promising unlimited Google reviews from “just an API key”, it is either using the Business Profile API and not telling you about the approval, or it is scraping, which breaks Google’s terms and stops working without warning. Proofloop does neither and says so up front.

Level 1: a Places API key, five minutes

This gets you your Google rating, your total review count, and the five most recent reviews Google exposes publicly — enough to seed a Wall of Love on day one.

Sign in to the Google Cloud Console with the account that manages your business.
Create a new project. Name it after your business so you can find it again.
Enable billing on the project. Google requires a card on file for Maps Platform APIs even though the free monthly allowance is far more than Proofloop uses — it caches aggressively and the five-review payload changes rarely.
Open APIs & Services → Library, search for Places API, and enable it.
Open Credentials → Create credentials → API key.
Restrict the key immediately. Under Application restrictions choose IP addresses and add your server’s IP. Under API restrictions, tick Places API only. An unrestricted key found in a log file is somebody else’s bill.
Paste it into Proofloop under Integrations → Google → Places API key and press Test.

Level 2: Business Profile API access

This is the one with the application. It gets you the full review history, notifications when a new review arrives, replying from the dashboard, and multi-location sync.

Before you start

Your Google Business Profile must be verified and active. An unverified profile is refused immediately.
It should have existed for at least 60 days. Brand-new profiles are the most common rejection.
You need a working business website on your own domain. Not a social media page, not a landing page builder subdomain.
The Google account you apply with must actually own or manage the locations.

The application, step by step

Use the same Cloud project you created for the Places API, or make a new one. Note the project number — the form asks for it and it is not the same as the project name.
Enable the APIs. In APIs & Services → Library, enable Google My Business Account Management API and My Business Business Information API. Some of these only appear in the library after your access request is approved; that is normal and not something you have done wrong.
Configure the OAuth consent screen. User type: External. Fill in the app name, support email, your website as the authorised domain, and a privacy policy URL that genuinely resolves. Add the scope https://www.googleapis.com/auth/business.manage.
Create OAuth client credentials. Type: Web application. Add the redirect URI that Proofloop shows you on the Google integration screen — copy it exactly, including https and any trailing path. A mismatch here produces redirect_uri_mismatch later and nothing else will explain it to you.
Submit the access request form. Google’s Business Profile API documentation links to it as Application for Basic API Access. You will be asked for your project number, your business website, and a description of your use case.
Wait. Around two weeks is typical. Google may email you for clarification; answer promptly, because an unanswered clarification is treated as an abandoned request.
Once approved, return to Integrations → Google in Proofloop and press Connect. You will be sent through Google’s consent screen and back.

“Quota: 0 queries per minute” means awaiting approval

This is not a credentials problem

Before your application is approved, Google sets your quota for these APIs to 0 queries per minute. Every call therefore fails, usually with a 403 and a message about the API not being enabled or the caller lacking permission. This looks exactly like a wrong client secret, and that is why it is the most predictable support ticket in this category.

It means your application has not been approved yet. Your credentials are fine. Re-creating them, re-doing the consent screen, or re-entering the client secret will change nothing and will not speed anything up.

Proofloop detects this case and names it correctly. When your quota reads zero, the Google integration screen says Awaiting approval and shows this guide — it does not show you a 403, and it does not show you a spinner that never resolves. You can confirm the quota yourself in the Cloud Console under APIs & Services → Quotas.

Meanwhile, nothing has stopped

While you wait, Proofloop keeps sending review requests, keeps routing customers to your Google review form, keeps collecting testimonials and keeps displaying widgets. The wait costs you the ability to read reviews back and reply from the dashboard. It costs you nothing else.

Why applications get refused

In roughly the order they come up. Most are fixable; you may reapply after addressing the reason.

Reason	What to do about it
A vague use case. “To manage reviews” is refused almost automatically.	Write four or five specific sentences. See the example below.
The Business Profile is unverified, suspended, or brand new.	Complete verification and let the profile run for 60 days before applying.
No real website, or a website that does not match the business.	Apply with a live site on your own domain that names the same business as the profile.
A privacy policy that does not exist or does not mention Google user data.	Publish one at a stable URL that states what data you access, why, how long you keep it, and how a user revokes access.
The use case implies reselling Google review data or building a public directory from it.	Describe managing your own or your clients’ locations. Google refuses aggregation and redistribution use cases.
Anything that sounds like automated replies to reviews.	Say that replies are drafted for human approval and sent by a person. That is what Proofloop actually does — AI drafts always require a human to approve them before they are posted.
The wrong project number, or a project with no APIs enabled.	Copy the project number from the Cloud Console dashboard, not the project name or ID.
An unanswered follow-up email.	Watch the inbox of the account you applied with, including the spam folder.

A use case with enough substance

Adapt this rather than copying it; a form full of identical submissions helps nobody.

We operate [BUSINESS NAME], a [TYPE] business with [N] verified locations in
[COUNTRY], each managed from the Google account making this request.

We use a self-hosted review management application installed on our own server
at [YOUR DOMAIN]. We need Business Profile API access for four things:

1. Read the complete review history for our own locations, so our managers can
   see all reviews in one place instead of switching between location dashboards.
2. Receive new reviews promptly so a negative review can be answered the same day.
3. Publish replies written and approved by our staff. Replies are never sent
   automatically; every reply is drafted, reviewed and approved by a person.
4. Report review volume and average rating per location to our management team.

We do not redistribute, resell, or publish Google review data outside our own
organisation, and we do not aggregate reviews for businesses we do not manage.
Our privacy policy is at [URL].

If you are an agency, say so plainly and say how many client locations you manage. Agency use is legitimate; hiding it is what causes problems.

Once you are connected

Status in Proofloop	What it means
Disconnected	Nothing connected. Everything except reading and replying to Google reviews works.
Awaiting approval	Quota reads 0 QPM. Your application is with Google. Nothing is wrong with your credentials.
Connected	Shows your quota, when the last sync ran, and how many locations are linked.
Error	Something specific went wrong. The message says what and offers a retry.

Sync runs every 24 hours by default and is safe to overlap — shared hosting cron can and does fire twice. Tokens are encrypted at rest and revoked when a workspace is deleted.

If Google says no

It happens, and it is not the end of anything. Fix whatever the refusal named and reapply; or add a Places API key, which needs no approval, and accept the five-review ceiling; or stay at level 0 and keep sending customers to Google with a Place ID, which is what actually grows your review count.

What you must not do is reach for a scraper. Third-party “Google review API” services that return unlimited reviews are scraping Google, which breaks Google’s terms, puts your clients’ profiles at risk, and stops working the day Google changes a selector. Proofloop will not integrate with them, and that is a deliberate product decision rather than an oversight.