Integration

Google reviews, where the API is gated and the rules are enforced

A Google Business Profile integration lets a Telegram bot surface new Google reviews to your team and post replies. API access requires Google's approval rather than a self-serve key, and selectively soliciting reviews based on sentiment breaches Google's policies and is enforced.

Google Business Profile integration: auth, limits and availability

Auth model: OAuth 2.0
Access: Requires an application to Google and explicit approval
GCC availability: Widely used across the UAE and GCC; requires a verified listing
Data flow: 5 hops, worker-mediated

As of 2025-10-01, Telegram Bot API 13.4

Why this integration exists

For a clinic, restaurant or garage in the Gulf, the Google rating is the most commercially significant number the business has, and it is managed badly almost everywhere. Reviews arrive unpredictably, nobody is watching, and a one-star review sits unanswered for a fortnight — which readers notice more than the review itself.

A bot fixes the watching problem cleanly. A new review lands in a Telegram topic within minutes, the manager sees it on their phone, and a reply can be drafted and posted without anyone opening a browser. Response time on negative reviews is one of the few things a business genuinely controls, and it visibly affects how the profile reads to a prospective customer.

Two constraints shape what can be built. Access to the API is not self-serve — Google requires an application and approval, which takes time and is not guaranteed, so it is a project dependency rather than a configuration step. And review solicitation is governed by policy: inviting only satisfied customers to review you is prohibited and enforced, which means a bot that gates the review invitation on a private rating is building a policy breach into the product.

How the data actually moves

Replies posted through the bot are public and permanent, so the confirmation step before posting is deliberate rather than decorative.

OAuth 2.0 against a Google account with management rights on the location, using a refresh token held as a Worker secret. Access to the Business Profile APIs must be requested from Google and approved before any of this works, which is worth starting well before the build.

Auth model: OAuth 2.0

Their limits, and what they mean for you

API access requires an application to Google and explicit approval.

A project dependency with a timeline Google controls and no guarantee of success. It belongs in the plan before the build rather than beside it.

Google prohibits soliciting reviews selectively based on expected sentiment.

A review invitation cannot be gated on a private rating. Businesses are penalised for this, and it is the single most common way a review flow is specified wrongly.

Review data is polled rather than pushed; there is no webhook for new reviews.

Freshness is bounded by the poll interval, which is minutes rather than seconds. Fast enough to matter and worth stating rather than implying real time.

A reply is public, attributed to the business, and can be edited but not withdrawn cleanly.

The bot confirms before posting. A reply drafted in irritation and sent from a phone in one tap is a permanent, public artefact.

How it fails, and what happens when it does

The integration is scoped and then blocked by Google's approval process.

Approval is treated as a gate before the build, not a formality alongside it. Building first and applying later risks a finished integration nobody can turn on.

A review invitation is gated on a private rating.

A policy breach with real penalties. The public review path is offered regardless of the private score, which is both compliant and produces a more credible rating.

A reply is posted with a typo or in anger.

A confirmation step, and where a review is below a threshold a required second approver. Public and permanent deserves more friction than a single tap.

The refresh token is revoked when a manager's access changes.

All operations stop. The failure alerts rather than retrying, since a revoked grant cannot be recovered by trying again.

Availability in the UAE and the wider GCC

Businesses with a verified Google profile

The prerequisite. An unverified or unclaimed listing cannot be managed through the API at all.

United Arab Emirates and GCC

Widely used and commercially significant for consumer-facing businesses. Multi-location groups can manage several locations under one integration.

API approval

Required, and granted at Google's discretion. Not guaranteed, and the timeline is not yours.

Review solicitation

Governed by policy rather than by the API. The API will let you build a gated flow; the policy will penalise you for running one.

When not to use this integration

Your Google profile is unverified. Nothing here works until the listing is claimed and verified.
You wanted to suppress negative reviews. That is what the policy prohibits and what this deliberately does not do.
Nobody will reply within a day. An alert nobody acts on is a notification, not a review strategy.
You cannot wait for API approval. The timeline belongs to Google and is a hard dependency.

What it runs on

Component	Version	Why
Cloudflare Workers	current	Scheduled polling, token refresh and reply posting.
Cloudflare D1	current	Seen reviews, reply drafts and approval state.
Zod	4.4	Validation of API responses across locations.
grammY	1.45	Manager alerts, draft replies and the approval flow.

Questions that come up during scoping

Can we only invite happy customers to leave a Google review?

No. Google prohibits soliciting reviews selectively based on expected sentiment and enforces it. The public review path is offered regardless of any private score, which keeps you compliant and produces a rating readers find more credible anyway.

Is API access self-serve?

No. Google requires an application and approval on their timeline, with no guarantee. It is a project dependency to start before the build rather than a configuration step to complete during it.

How quickly does the bot see a new review?

Within the poll interval, which is minutes rather than seconds, because there is no webhook for reviews. Fast enough to change how a business responds, and worth stating plainly rather than implying real time.

Should managers be able to reply straight from Telegram?

With a confirmation step, and for low-rated reviews a second approver. A reply is public, attributed to the business and effectively permanent, which deserves more friction than one tap on a phone.

Can we manage several locations?

Yes, under one integration, with alerts routed per location. For a group this is most of the value, since the alternative is somebody checking each profile manually and nobody doing it consistently.

What does this actually improve?

Response time on negative reviews, which is one of the few things a business fully controls and which readers notice. It does not raise your rating directly; it stops a bad review sitting unanswered where every prospective customer can see it.