Authentication

Loyalty Engine supports two authentication methods. Choose based on your integration type.

API Key Authentication

Pass your API key in the X-API-Key request header. This is the recommended method for server-to-server integrations and POS systems.

sk_test_* keys are for development and testing — they use a separate isolated environment. No real transactions occur.
sk_live_* keys are for production. Keep these secret.

BASH

# API Key — server-to-server / POS integrations
curl https://loyalty-engine-production-e5cb.up.railway.app/tenants/YOUR_TENANT_ID/members \
  -H "X-API-Key: sk_test_YOUR_KEY"

Security: Never store API keys in localStorage, sessionStorage, or client-side JavaScript. Use memory only (environment variables on the server, secure credential storage on mobile).

JWT Bearer Tokens

For portal integrations, pass a JWT in the Authorization: Bearer header. Tokens are issued by the Loyalty Engine auth service (AWS Cognito in production, local RSA key pair in development).

BASH

# JWT Bearer — portal integrations
curl https://loyalty-engine-production-e5cb.up.railway.app/tenants/YOUR_TENANT_ID/members \
  -H "Authorization: Bearer <your_jwt_token>"

Rate Limits

API endpoints are rate-limited per API key. When you exceed the limit, the API returns a 429 Too Many Requests response with a Retry-After header indicating how many seconds to wait before retrying.

Tier	Requests / minute
Test keys	60
Live keys	600