Skip to main content
EthioReview returns standard HTTP status codes. Error bodies usually include a short message you can log or surface in your own UI.

​
Status codes

​
Auth failures

​
Missing or wrong key

Returns 401 or 403 if the publishable key is missing, revoked, or not recognized.

​
Secret key in the browser

Partner routes expect:
If you send a publishable key (pk_*) as a Bearer token, the request fails. Keep secrets on your server only.

​
Origin / CORS failures

Browser widget calls check Origin (or Referer) against the API client’s allowed origins. Symptoms:
  • Network tab shows 403
  • Console shows a CORS error
  • Dashboard Sandbox test preview is blank
Fix: add the exact origin (scheme + host + port, no path) under Integrations → API keys. See Allowed origins.

​
Environment mismatch

A sandbox key (pk_test_*) cannot resolve a production widget, and a live key (pk_live_*) cannot resolve a sandbox widget. The API responds with 403 and a message like Widget environment mismatch.
Always pair pk_test_* with a Sandbox widget and pk_live_* with a Production widget.

​
Empty reviews (not always an error)

A 200 with an empty reviews array means the request succeeded but no testimonials matched your filters (for example minStars: 4 on an org with no active 4+ star reviews). In sandbox, you should always see synthetic testimonials when the key and widget are configured correctly. If sandbox returns empty, check the key environment and allowed origins first.

​
Debugging checklist

1

Confirm the key prefix

pk_test_* for sandbox, pk_live_* for production.
2

Confirm the widget environment

Integrations → Review widgets — environment must match the key.
3

Confirm allowed origins

Exact match for localhost or your live domain.
4

Hit the API directly

Authentication → · Allowed origins →