Authentication

All Partner API requests require an API key and the identifier of the loyalty scheme to which the request applies.

Required headers
X-ApiKey:

X-ApiKey
Your API key identifies the calling integration. Store it securely and send it only from a trusted server. Do not include it in browser or mobile-app code.

X-Scheme
X-Scheme is the UUID of the Loyale scheme you are integrating with. The same API key may have different permissions in different schemes.

Example
curl --request GET
--url https://partner-api.loyale.io/api/Customer/List
--header 'X-ApiKey: '
--header 'X-Scheme: '

Permissions
Some endpoints require a scoped key. Available scopes include api.pos.transactions.read, api.pos.transactions.write, api.terminal.sessions.read, and api.terminal.sessions.write. Legacy full-access keys remain supported for backwards compatibility.

Errors
Requests with missing, invalid, or unauthorised credentials return HTTP 401 Unauthorized. Check that both headers are supplied and that X-Scheme is a valid scheme UUID.