Overview

API keys let you authenticate with the LoyaltyLion API. Each key contains a unique token and a defined set of permissions (called scopes). API keys can be disabled or deleted at any time.

Creating API keys

To create or view your API keys, go to your LoyaltyLion dashboard, click Settings at the bottom left, and then API keys. Only users with the Admin role can see this page.

You will be able to see a list of all existing API keys here. For each key, you will be able to see:

The key's name
The first 9 characters of the token
When the key was created
When the key was last used
Whether the key is active or disabled

Click Create API key to generate a new key. Give your key a name, and choose which permissions (scopes) it should have, based on what the application or integration you're connecting needs.

Click Create. We create the key and show you its token.

❗️Important: Make sure you save this token in a secure location, because you can’t view it again after you leave this screen. If you lose it, create a new key.

Editing, disabling and deleting API keys

Click a key in the list to open Edit API key. There you can change its name and scopes, or turn Active off to disable it. To delete the key, click Delete and confirm. Deleting a key can’t be undone, and any integration using it stops working.

Apps you connect by signing in with your LoyaltyLion account, such as the LoyaltyLion connector for Claude, don’t use an API key. They are listed under Connected apps on the same page, where you can revoke their access.

API key scopes

Each API key has a set of permissions (scopes) that determine what it can do. Enable only the scopes your integration needs. A write scope also gives read access to the same resource.

Scope	Description
read_customers	Read information about customers, such as their tier, points and rewards. Does not include order information.
write_customers	Make updates to customers, such as adding points or redeeming rewards.
read_orders	Read information about orders.
write_orders	Create and update orders.
read_reviews	Read information about reviews.
write_reviews	Create, update, and delete reviews.
read_unsubscribes	Read the loyalty emails unsubscribe list.
write_unsubscribes	Modify the loyalty emails unsubscribe list.
write_configuration	Modify program configuration, such as rules and rewards.
read_audit_log	Read the audit log: who changed what across your program and account, including the customer each change affected. The audit log is available on the Plus plan.
all	Full read and write access to all resources.

API keys and older credentials

Two other credentials sit under Settings > General. The Token and secret is the older way to authenticate API requests and is deprecated. Use an API key instead. The SDK secret token is for signing customer session tokens on a headless store, not for API requests.