Subscribe to LoyaltyLion webhooks and verify inbound payload signatures
domain: developers.loyaltylion.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Decide whether you're registering via OAuth app or a direct API key, since this determines which secret verifies signatures later.
POST /v2/webhooks with a topic (e.g. program_events/customer.enrolled, .points_earned, .claimed_reward) and an HTTPS address.
In your endpoint, read the raw request body and compute an HMAC-SHA256 using the OAuth client secret (for OAuth-registered webhooks) or site secret (for API-key-registered webhooks), comparing it to the x-loyaltylion-hmac-sha256 header.
Respond with a 2xx within the documented short timeout window regardless of downstream processing time, and process asynchronously if needed.
Deduplicate deliveries using the payload's id field, since delivery is at-least-once.
Known gotchas
Signature verification must use the exact raw body bytes; re-serializing the JSON before hashing will break verification.
Webhook subscriptions are visible only to the client (OAuth app or API key) that created them.
After a bounded number of consecutive delivery failures (with an earlier email warning), LoyaltyLion auto-removes the subscription and you must re-register it.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?