API and Webhooks for Developers: Building a Custom Loyalty Integration

WeLoyal is a digital loyalty card platform with a full REST API and webhook system underneath its native integrations, letting developers and agencies build custom connections into a point of sale system, e-commerce platform, or internal tool that doesn't already have a ready-made integration. Not every business runs on Toast, Square, or Shopify, and for the developers and technical teams supporting businesses on other systems, this post explains exactly how the API and webhook layer works, what actions it exposes, and how it compares to using a no-code automation tool instead.

Why the API exists, and what it actually is

Every native integration described elsewhere on this site, the Toast connection, the Square connection, the Shopify connection, is built on top of the exact same underlying API available to any developer directly. This matters because it means using the API directly puts a developer at no functional disadvantage compared to the pre-built integrations, the same actions, the same data, and the same reliability sit underneath both. For a business running a point of sale system or an internal tool that doesn't have a ready-made connection, the API is simply the direct route to building that same kind of automatic accrual and management functionality themselves.

How authentication and access work

Access to the API runs on a straightforward API key, generated and found directly within a business's account under its integration settings. That key gets included with each request to authenticate it, and from there, the full range of available actions becomes accessible. The system applies a rate limit of ten requests per second, which comfortably covers real-time transaction processing for the vast majority of businesses, including fairly high-volume ones, and returns clear error responses if that limit is ever exceeded, making it straightforward for a developer to build in appropriate handling on their end.

The core transaction actions

The API is built around a set of specific actions that map directly onto what a staff member does manually when using the scanner in person, which keeps the logic consistent whether a transaction is being processed by a human at a counter or triggered automatically by code. Adding a stamp to a stamp card, adding or subtracting points on a cashback, reward, or discount card, adding or subtracting a visit on a multipass or a limited membership tier, recording a purchase amount for revenue tracking purposes, and issuing an available reward once a customer has earned one are all available as direct, individual actions. Each of these is scoped specifically to the card types it logically applies to, a visit-based action only makes sense against a multipass or a capped membership, a stamp action only against a stamp card, which keeps the API predictable and prevents a developer from accidentally trying to apply logic that doesn't fit a given card's actual mechanic.

Management functions beyond simple transactions

Beyond processing individual transactions, the API also exposes the broader management functions needed to run a loyalty program programmatically from end to end. This includes retrieving a full list of a business's active cards, issuing a brand new card directly to a specific customer without them needing to scan a QR code themselves, pulling detailed information on an individual customer's current status and history, updating or deleting customer records as needed, retrieving the card templates a business has built, and sending push notifications directly through code rather than manually through the dashboard interface. For agencies managing multiple business accounts, or for larger multi-location operations, further endpoints exist for managing sub-accounts and reseller-specific settings entirely programmatically as well.

Webhooks: getting notified the instant something happens

Alongside the request-based API, a webhook system lets a business's own systems get notified automatically the moment specific events happen on the loyalty side, without needing to constantly poll the API to check for updates. A webhook can fire the instant a new card is installed, the instant a reward gets redeemed, or on various other meaningful events within the platform, letting a developer build real-time reactions into their own systems. A business might use this to trigger an internal Slack notification whenever a high-value reward is redeemed, to sync new loyalty members automatically into a separate CRM the moment they install a card, or to feed loyalty activity data directly into a business intelligence tool for deeper analysis alongside other operational data.

When a no-code tool makes more sense than writing custom code

Not every business connecting to the API needs, or wants, custom-built code. For businesses and agencies that would rather wire up automations without writing anything from scratch, the same underlying actions are available through popular no-code automation platforms including Zapier, Make, Pabbly, and Integrately, among others. This opens up the exact same functionality, issuing cards, adding points, sending notifications, triggering off webhook events, through a drag-and-drop interface instead of raw code. A business might use this to automatically issue a loyalty card the moment someone fills out a form on their website, to log every redemption into a spreadsheet for manual review, or to connect loyalty activity into a marketing tool that isn't natively integrated, all without a developer needing to be involved at all.

What kind of businesses actually need this level of access

The direct API and webhook layer tends to matter most for a specific set of situations, a business running a point of sale or booking system that doesn't have a native integration already built, an agency managing loyalty programs across several client accounts and wanting to automate account setup and reporting at scale, a business with an existing internal tool, a booking platform, a CRM, an inventory system, that needs loyalty data to flow in or out automatically rather than being managed as a separate, disconnected system, and a developer building something genuinely custom, a bespoke kiosk experience, a unique redemption flow, that goes beyond what the existing scanner and dashboard already cover well.

At a glance: the API and webhook system

Authentication:

• Simple API key, generated in account integration settings
• Ten requests per second rate limit, clear error responses if exceeded

Transaction actions available:

• Add a stamp
• Add or subtract points
• Add or subtract a visit
• Record a purchase amount
• Issue an available reward

Management functions available:

• List all active cards
• Issue a new card directly to a customer
• Retrieve and update customer records
• Retrieve card templates
• Send push notifications programmatically
• Manage sub-accounts and reseller settings for agencies

Webhooks:

• Real-time notifications on events like card installs and redemptions
• No need to continuously poll the API for updates

No-code alternative:

• Full functionality also available through Zapier, Make, Pabbly, Integrately, and similar platforms
• No custom code required for most common automation needs