External API and API keys

Use the stmpr API to connect a POS, ecommerce backend, or your own server-side application. You can read loyalty data, find customers, issue stamps, redeem rewards, and enroll customers.

API keys belong to the store rather than one loyalty card. Every request supplies the relevant Wallet ID and, when needed, Customer ID.

Treat an API key like a password. Create the least powerful key that works, store it in a server-side secret manager, and revoke it immediately if exposed.

https://stmpr.io/dashboard/developers

Step by step

1. Open Developers, then API & Webhooks.
2. Create a named API key and enable write access only if the integration must change loyalty data.
3. Copy the Wallet ID from API setup and the Customer ID from the customer detail page.
4. Send the key as a Bearer token from a server-side environment.
5. Use a unique idempotency key for every write operation so retries cannot duplicate stamps or redemptions.
6. Test successful, invalid-ID, unauthorized, validation, and repeated-request responses before launch.

Before going live

• Never put an API key in browser JavaScript, a Shopify theme, or a mobile app.
• Keep separate keys for separate systems so one connection can be revoked safely.
• Log the request reference and stmpr response, but never log the full API key.
• Handle 4xx validation errors separately from retryable network or 5xx failures.

Related articles and pages

• Webhooks and delivery log
• stmpr API documentation