Authentication

Every request requires a Bearer token. Sandbox keys are prefixed sk_test_; production keys with sk_live_. Keep them server-side, never ship a live key in client code.

curl https://api.sticky.co/v1/customers \-H "Authorization: Bearer sk_test_8K2x...QpWb" \-H "Sticky-Workspace: ws_kendalls_cannabis"

Errors & rate limits

Standard HTTP codes. Errors come back as JSON with a type, code, and human-readable message. Default rate limit is 100 req/sec per workspace.

Create a customer

Creates a customer record. Phone is required (we de-dupe on it). Email is optional but enables email channels.

POST /v1/customers{"phone": "+13035551234","email": "sam@example.com","first_name": "Sam","consent": { "sms": true, "source": "in-store-kiosk" }}

{"id": "cus_8K2xQp","created_at": "2026-04-29T14:08:32Z","phone": "+13035551234","tier": "bronze","points_balance": 0}

Push a loyalty event

The most common write you'll do. Event type determines points awarded, tier evaluation, and journey triggers.

await sticky.events.create({type: 'order.completed',customer_id: 'cus_8K2xQp',amount_cents: 14400,items: [{ sku: 'cd-pre-1g-1', qty: 2 }]})

Mint a wallet pass

Returns a signed install URL for both Apple Wallet and Google Wallet. The URL is single-use and expires in 24 hours.

{"id": "pass_2VnQ4z","customer_id": "cus_8K2xQp","install_url": "https://wallet.sticky.co/i/2VnQ4z","apple_url": "https://wallet.sticky.co/a/2VnQ4z.pkpass","google_url": "https://pay.google.com/gp/v/save/eyJ...","expires_at": "2026-04-30T14:08:32Z"}

Subscribe to events

Sticky signs every webhook with HMAC-SHA256. Signature is in the Sticky-Signature header. Retries: 6 attempts over 24 hours with exponential backoff.

{"url": "https://api.yourbrand.com/sticky/webhook","events": ["customer.tier_changed","pass.installed","journey.entered"]}