About the API

A REST API to connect your loyalty program to your own systems, from your server or straight from your website.

The Loybox API does the same things the dashboard does, but from your code: recording purchases that earn points, showing the reward catalog, redeeming codes and looking up a member's state.

It is a REST API over HTTPS. Everything goes back and forth as JSON, field names are in snake_case and dates are ISO 8601 with a time zone (2026-03-14T18:30:00Z).

Base URL

Every route in this reference hangs off:

https://loybox-public-api-752998171300.southamerica-west1.run.app

The version goes in the first path segment (/v1/...). When an endpoint changes in a non-compatible way, a new version appears alongside the old one, and the old one keeps working: that is the case with looking up a code and its version 2.

The examples

Every endpoint page carries the whole call in curl, ready to paste into a terminal. Three things are variables and apply to every example:

In the exampleWhat to put
$LOYBOX_API_KEYYour API key. Export it in the environment; do not paste it into the command.
$ACCESS_TOKENThe end-user token that the login returned.
X-Commerce-Id: 87Your commerce id.

Machine format

The API is also published as a specification, so you can generate a client instead of writing one:

https://docs.loybox.com.ar/openapi.json

It is OpenAPI 3.1 and covers all 25 endpoints, the response schemas and the two credentials. If you are integrating with the help of an agent, hand it that URL.

The specification is in Spanish

There is one openapi.json for all three languages, and its field descriptions are in Spanish. Field names, endpoint paths and schemas are language-neutral, so a generated client is identical either way.

The two ways to integrate

This is the most important decision, and it is worth making before writing code, because it changes the credential, the available endpoints and where your code runs.

Every section of this reference uses one of the two, and every endpoint page says which at the top:

SectionCredentialWhat for
ConsumptionsAPI keyRecording purchases that earn points
ClientsAPI keyLooking up members and their benefits
BenefitsAPI keyCatalog, code lookup and redemption
AuthenticationEnd-user sign-in by email
My accountEnd-user tokenThe user's points, purchases and history
PublicBrand and catalog, without signing in

The API key never goes in the frontend

The commerce API key grants access to the data of all your members. It lives on your server only. What can live in the browser is the end user's access token, which only sees their own data.

What responses look like

Responses have no envelope: the object comes at the root, and lists come back as a plain array.

// GET /v1/clients/12345
{
  "code": 12345,
  "username": "Ana Pérez",
  "email": "ana@example.com",
  "points": 340
}

Optional fields are present and set to null, not absent. You can read them without checking whether they exist, but you do have to check whether they are null.

Pagination

There are two schemes, and each one lives in a single endpoint:

Limit and offset

Listing clients uses limit and offset, and returns the total so you can build page numbers.

// GET /v1/clients/list?limit=20&offset=40
{
  "items": [],
  "total": 1875,
  "limit": 20,
  "offset": 40
}

limit goes from 1 to 100 and defaults to 20. offset starts at 0.

Cursor

My history uses a cursor, because it is a list that grows at the top and page numbers would shift under you. You request the next page by passing the previous response's next_cursor in ?cursor=.

// GET /v1/me/activity
{
  "results": [],
  "next_cursor": "eyJkIjoiMjAyNi0wMy0xNCJ9",
  "previous_cursor": null
}

When next_cursor comes back null, there are no more pages.

Where to start