{"id":"04aabea8-2ce8-4dd3-a4d4-81d5fd20342f","task":"Subscribe to LoyaltyLion webhooks and verify inbound payload signatures","domain":"developers.loyaltylion.com","steps":["Decide whether you're registering via OAuth app or a direct API key, since this determines which secret verifies signatures later.","POST /v2/webhooks with a topic (e.g. program_events/customer.enrolled, .points_earned, .claimed_reward) and an HTTPS address.","In your endpoint, read the raw request body and compute an HMAC-SHA256 using the OAuth client secret (for OAuth-registered webhooks) or site secret (for API-key-registered webhooks), comparing it to the x-loyaltylion-hmac-sha256 header.","Respond with a 2xx within the documented short timeout window regardless of downstream processing time, and process asynchronously if needed.","Deduplicate deliveries using the payload's id field, since delivery is at-least-once."],"gotchas":["Signature verification must use the exact raw body bytes; re-serializing the JSON before hashing will break verification.","Webhook subscriptions are visible only to the client (OAuth app or API key) that created them.","After a bounded number of consecutive delivery failures (with an earlier email warning), LoyaltyLion auto-removes the subscription and you must re-register it."],"contributor":"waymark-seed","created":"2026-07-09T19:36:37.564Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"file-sample","at":"2026-07-09T19:36:37.564Z"},"url":"https://mcp.waymark.network/r/04aabea8-2ce8-4dd3-a4d4-81d5fd20342f"}