Using the Passtastic API
What the API lets you do
The Passtastic API lets you connect your own systems — a custom POS, a CRM, an internal app — directly to your loyalty program. With it you can:
- Enroll customers and issue wallet passes from your own signup flow
- Add stamps or points, and check a customer's balance, from your own checkout or back office
- Get notified in real time with webhooks — instead of polling, Passtastic pushes an event to your system the moment something happens (a customer enrolls, a reward is redeemed, and more)
This is for merchants building a custom integration. If you just want an out-of-the-box connection, see Connect Square POS or POS Systems & Integrations — no code required.
API access depends on your plan. If it isn't included, you'll see an upgrade prompt when you open API & Webhooks in Settings.
Get an API key
1. Open Settings, then API & Webhooks (under Business).
2. On the API keys tab, click Create key.
3. Give it a key name so you know what it's for later (e.g. "Production CRM").
4. Your new key is shown once, in the Your new API key window. Copy it now — you won't be able to see it again. Click Copy, or Show to reveal it first.
Treat this key like a password. Anyone with it can act on your account through the API.
5. Store the key securely in your own system (an environment variable, a secrets manager) and send it as the request's authentication header — see the technical reference below for the exact header format.
Only admins can create or revoke API keys.
Lost or compromised a key?
Keys aren't shown again after creation. If you've lost one, or think it's been exposed, open API keys and click Revoke on it — this stops it from working immediately — then create a new one and update your integration.
Set up a webhook
Webhooks let your system react the moment something happens in Passtastic, without you having to keep asking the API for updates.
1. On the Webhooks tab, click Add endpoint.
2. Enter the Endpoint URL — the address on your own system that will receive the event (e.g. `https://your-system.com/hook`).
3. Under Events, choose which events to receive:
- Customer enrolled
- Balance updated
- Level changed
- Reward redeemed
4. Save it. Your signing secret is shown once, in the Signing secret window — copy it now. Use it to verify that a webhook request really came from Passtastic (the technical reference explains how to check the signature).
Only admins can create or edit webhooks.
Each webhook endpoint shows its recent deliveries, so you can check whether a call succeeded or failed, and replay a failed delivery once your system is back up — no need to wait for the next event.
Editing or turning off a webhook
Open the endpoint and click Edit to change its URL or events, or set its status to Disabled to pause deliveries without deleting it. Click Delete to remove it for good.
Where to find the full technical reference
This guide covers the dashboard side — creating keys and webhooks. For endpoints, request/response formats, authentication headers, error codes, and code samples, see the full API documentation. You can also reach it any time from the Read the API docs link at the top of the API & Webhooks page.