Using the Passtastic API
What the API lets you do
The Passtastic API lets you connect your own systems — a custom POS, a CRM, an internal app — directly to your loyalty program. With it you can:
- Enroll customers and issue wallet passes from your own signup flow
- Add stamps or points, and check a customer's balance, from your own checkout or back office
- Get notified in real time with webhooks — instead of polling, Passtastic pushes an event to your system the moment something happens (a customer enrolls, a reward is redeemed, and more)
- Reuse the customers you already have — if someone your system enrolls already signed up through your sign-up page, Passtastic recognises them by email or phone and adds your reference to the card they already carry, instead of issuing a second one
This is for merchants building a custom integration. If you just want an out-of-the-box connection, see Connect Square POS or POS Systems & Integrations — no code required.
API access depends on your plan. If it isn't included, you'll see an upgrade prompt when you open API & Webhooks in Settings.
Get an API key
1. Open Settings, then API & Webhooks (under Business).
2. On the API keys tab, click Create test key to try it out safely, or Create live key once you're ready to connect real customers.
3. Give it a key name so you know what it's for later (e.g. "Production CRM").
4. Your new key is shown once, in the Your new API key window (Your new test key for a test key). Copy it now — you won't be able to see it again. Click Copy, or Show to reveal it first.
Treat this key like a password. Anyone with it can act on your account through the API.
5. Store the key securely in your own system (an environment variable, a secrets manager) and send it as the request's authentication header — see the technical reference below for the exact header format.
Only admins can create or revoke API keys.
Try it first with a test key
Test keys work on every plan, including your trial — no upgrade needed. Test customers get a real Wallet pass marked TEST and are removed after 30 days, so there's nothing to clean up by hand.
Follow the Quickstart in the technical docs with your test key — it walks through enrolling a test customer and adding a card to your own phone, so you can see the whole flow before it ever touches a real one.
Once your integration works end-to-end, come back to API & Webhooks and click Create live key to switch to real customers. Live keys are available on Multi-Location and above.
Lost or compromised a key?
Keys aren't shown again after creation. If you've lost one, or think it's been exposed, open API keys and click Revoke on it — this stops it from working immediately — then create a new one and update your integration.
Set up a webhook
Webhooks let your system react the moment something happens in Passtastic, without you having to keep asking the API for updates.
1. On the Webhooks tab, click Add endpoint.
2. Enter the Endpoint URL — the address on your own system that will receive the event (e.g. `https://your-system.com/hook`).
3. Under Events, choose which events to receive:
- Customer enrolled
- Balance updated
- Level changed
- Reward redeemed
- Card expired
- Card renewed
4. Save it. Your signing secret is shown once, in the Signing secret window — copy it now. Use it to verify that a webhook request really came from Passtastic (the technical reference explains how to check the signature).
Only admins can create or edit webhooks.
Each webhook endpoint shows its recent deliveries, so you can check whether a call succeeded or failed, and replay a failed delivery once your system is back up — no need to wait for the next event.
Editing or turning off a webhook
Open the endpoint and click Edit to change its URL or events, or set its status to Disabled to pause deliveries without deleting it. Click Delete to remove it for good.
Where to find the full technical reference
This guide covers the dashboard side — creating keys and webhooks. For endpoints, request/response formats, authentication headers, error codes, and code samples, see the full API documentation, or jump straight to the API reference for every endpoint's request/response schema. You can also reach both any time from the Read the API docs and API reference links at the top of the API & Webhooks page — the API reference opens in a new tab.