Skip to main content
The LoyaltyDog API uses bearer token authentication. Every request must include an Authorization header containing a valid token.

​
Token types

LoyaltyDog issues two token shapes:

​
Multi-tenancy

All resources are scoped to a programId. Tokens are bound to a merchant; the API rejects any request that targets a program your token does not own. This program-based isolation is enforced server-side — there is no client-side filtering to bypass.

​
MFA on user logins

End-user authentication (for example, merchant staff signing into the dashboard) supports TOTP-based MFA via the /v2/token/mfa/* endpoints. Programmatic API access uses tokens directly and does not require MFA.

​
Rotating tokens

Treat tokens like passwords. To rotate:
  1. Issue a new token (via the dashboard or POST /v2/appkeys).
  2. Deploy the new token to your services.
  3. Revoke the old token.
Use a secrets manager — AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault, Infisical, or your platform’s equivalent — and never bake tokens into images or commit them.

​
Common errors

​
Next steps

Quickstart

Walk through your first authenticated request.

API reference

Browse every endpoint and schema.