I run a few local service businesses. One of them — a cash home-buying operation in Sioux Falls — just rebuilt its Google Business Profile from scratch after the old listing got shut down. New profile, zero reviews, no local-pack ranking. The kind of position where every review reply, every weekly post, and every insight pull genuinely moves the needle.

Most operators in this situation pay Birdeye, Podium, or a similar reputation-management tool $200–$400 a month to automate the basics: auto-replies, scheduled posts, review monitoring, performance dashboards. I priced it out. The math is bad. For three locations across two brands, I’d be paying close to $900 a month for what is, technically, a thin wrapper around an API Google already publishes for free.

So I went to build it myself. That’s where it got interesting.

The API exists. Google doesn’t want you to use it.

The Google Business Profile API is real and documented. You can list locations, pull reviews, post replies, publish updates to the “Posts” section of your listing, and pull performance metrics (calls, direction requests, website clicks, search queries). All the things the $300/month tools sell as “AI-powered insights.”

You enable it the normal way: spin up a Google Cloud project, enable the APIs, set up OAuth, get tokens. I did this in about an hour. Then I made my first call.

It returned HTTP 429 — RESOURCE_EXHAUSTED.

That’s the rate-limit error. Which is weird, because I’d made exactly one request. I checked my quota in the GCP console. It said quota_limit_value: "0". Zero requests per minute, ever, for any endpoint.

That’s not a rate limit. That’s a denial dressed up to look like a rate limit.

The thing nobody writes about

Here’s what I couldn’t find documented anywhere on the public internet, and what every blog post about “how to use the Google Business Profile API” leaves out:

Enabling the API is not the same as getting access to the API.

Google requires a separate, manual, one-time access-request approval before they’ll give your GCP project any quota at all. Until you’re approved, your project is enabled-but-throttled-to-zero. The API responds normally — it just rejects every call with a 429 that has nothing to do with how many requests you’ve made.

This is the gate. And it’s invisible from inside the GCP console. There’s no banner. No warning. No “your access is pending.” Just zeros in your quota.

A few specific traps to know about:

It’s a 429, not a 403. Most developers see 429 and assume they need to slow down their requests. They don’t. They need to fill out a form.
API keys don’t work. The Business Profile API rejects API keys with 401 — it requires OAuth 2.0 because the data is user-owned, not project-owned. So even if you’re approved, key-based auth is dead on arrival.
Approval is per-GCP-project, not per-Google-account. If you’ve already been approved for one project (say, the Google Ads API), that does not carry over. Each project starts at zero.
Your GBP must be at least 60 days old and verified. New listings get auto-rejected on age. If you just claimed your profile, you have to wait two months before they’ll even consider the request.
Sign in as the GBP owner, not a manager. If you submit the form from a manager-level Google account, it gets bounced.

None of this is documented in the API reference. You find it by getting denied.

The access-request form

The form is at: support.google.com/business/contact/api_default

In the dropdown, select “Application for Basic API Access.” That’s the one. The other options route to product support, not the API team.

Google’s stated review window is 7–10 business days. In practice, I’ve seen people report anywhere from 4 days to 6 weeks. They send you a confirmation email with a case number; that’s how you know it’s actually in the queue.

What to put in the form matters. The reviewers are looking for a legitimate operator use case, not a generic “I want to integrate with my app” request. Things that help:

Name your specific business and verified GBP location.
Describe the internal use case (replying to my own reviews, posting to my own profile) rather than a multi-tenant SaaS pitch unless you actually are a SaaS.
Mention the specific endpoints you need (e.g., mybusiness.googleapis.com/v4/accounts/*/locations/*/reviews).
Don’t oversell it. “I want to automate review responses and weekly posts for my own business” is a stronger application than “Building an AI-powered omnichannel reputation platform.”

What’s actually worth automating once you’re in

The temptation is to build something fancy. Resist it. The reason small businesses pay $300/month for these tools isn’t that the automation is sophisticated — it’s that they don’t have time to do four small things consistently. Build those four things and you’ve already won.

1. Auto-reply to new reviews. Not full auto-send (you’ll regret that the first time someone leaves a serious complaint). Auto-draft a reply within five minutes, push it to your phone, one-tap send. Five-star reviews can fully auto-send if you want. Three-star and below should always have a human in the loop.

2. Weekly Posts on autopilot. Google’s local-pack algorithm rewards “freshness.” A GBP that posts weekly outranks one that posts quarterly, all else equal. Build a small content queue and have a script publish one post per week to your Posts feed. Done.

3. Pull insights into a single dashboard. The performance API gives you website clicks, phone calls, direction requests, and search queries by day. That’s the data your competitors are paying $300/month to see in a slick UI. Pull it into a Google Sheet or a single-page dashboard and you’re already ahead of 90% of local businesses.

4. Review-velocity tracking. Count reviews per week, flag when velocity drops, alert when you get a negative one. This is twenty lines of code. It’s the difference between catching a reputation problem in 24 hours versus three weeks.

You’ll notice none of this requires AI in any meaningful sense. It’s just four cron jobs and a webhook. The hard part isn’t the automation — it’s getting past the approval gate to be allowed to do it.

The endpoint map

If you’re actually going to build this, the API is split across four different base URLs, which is its own little annoyance:

What you want to do	Base URL
List accounts you own	`mybusinessaccountmanagement.googleapis.com/v1`
List + update locations, business info	`mybusinessbusinessinformation.googleapis.com/v1`
Reviews, review replies, Posts	`mybusiness.googleapis.com/v4` (yes, the legacy v4)
Performance metrics	`businessprofileperformance.googleapis.com/v1`

Google migrated most of the API to v1, but reviews and posts are still trapped on the legacy mybusiness.googleapis.com/v4 endpoint. They’ve said for years they’ll migrate them. They haven’t. Build for v4 for reviews and don’t lose sleep over it.

OAuth scope you need: https://www.googleapis.com/auth/business.manage. One scope covers all four base URLs.

So how long until I’m in?

I submitted my request on a Sunday. Got the auto-confirmation with a case number within the hour. The stated window puts the answer somewhere between 7 and 10 business days. I’ll update this post when I hear back.

In the meantime, if you’re running a local service business and you’re not already on one of the $300/month tools, here’s the order of operations:

Today: file the access-request form. Even if you don’t plan to build immediately, get in the queue. Approval doesn’t expire — your future self will thank you.
This week: claim and verify your GBP if you haven’t. Make sure you’re the owner, not a manager.
Build the OAuth flow now. It works without API access. You can write and test the whole pipeline against a stub; the moment your quota flips from 0 to non-zero, your code starts working.
Save your money. Don’t sign a 12-month Birdeye contract while you’re waiting on a 10-day approval window.

The $300/month reputation tools aren’t selling you automation. They’re selling you the right to skip the approval gate. Once you’re past it, the actual automation is a weekend project.

If you want help building the four-job stack — reviews, posts, insights, alerts — that’s the kind of thing we do here. Drop me a line and I’ll send you the scaffold I’m using for my own businesses.