Build on the loyalty layer
cannabis ops actually trust.
A REST API, signed webhooks, and a developer sandbox. Sandbox keys are free, production access is approval-gated, because cannabis means strict compliance.
// Push a sale event, a customer just bought 2 pre-rolls import Sticky from '@sticky/node'; const sticky = new Sticky(process.env.STICKY_KEY); await sticky.events.create({ type: 'order.completed', customer_id: 'cus_8K2xQp', amount_cents: 14400, items: [{ sku: 'cd-pre-1g-1', qty: 2 }] }); // → triggers points award + tier eval + journey enrollment // → fires `customer.tier_changed` webhook if applicable
- Sandbox + production environments
- HMAC-signed webhooks with 24h retry
- Native wallet pass minting
- Test phone numbers, no real SMS sent
Everything you can read, write, and listen to.
Phone-first identity, points, tier, consent, and metadata. Idempotent upserts. PII redaction on demand.
Push orders, visits, referrals. Sticky handles points, tier eval, and journey enrollment server-side.
Mint Apple Wallet & Google Wallet passes. Push live updates that hit the lock screen in seconds.
Send transactional email and SMS through Sticky's compliance layer. TCPA, quiet hours, and STOP all enforced.
Read computed segments, evaluate a customer against rules, or trigger custom recompute on-demand.
Subscribe to 24 event types. HMAC signed, exponential backoff, full delivery log per endpoint.
Listen to what your customers actually do.
We sign every webhook with HMAC-SHA256 in the Sticky-Signature header. Failed deliveries retry 6 times over 24 hours with exponential backoff. Replay any event from the dashboard or via /v1/webhooks/log.
import crypto from 'crypto'; export function verifySticky(req, secret) { const sig = req.headers['sticky-signature']; const body = req.rawBody; const expected = crypto .createHmac('sha256', secret) .update(body) .digest('hex'); if (!crypto.timingSafeEqual( Buffer.from(sig), Buffer.from(expected) )) throw new Error('invalid signature'); return JSON.parse(body); }
Public roadmap & changelog.
We ship something every Friday. Subscribe to changelog updates and get the diff in your inbox.
Pass an Idempotency-Key header on event creation. Replays return the original response, so retries from a failing webhook handler are safe.
Define re-usable Apple/Google pass templates programmatically. Mint passes from a template ID instead of duplicating layout JSON.
Read-only at first. Useful for building dashboards that aggregate customers + events + segments without three round trips. Want in?
Build apps that operators can install across their workspaces, standard OAuth 2.0 with scoped permissions.
Tell us what you're building.
Why we approve manually: cannabis APIs touch real customer PII, real consent records, and real wallet passes that go in real wallets. We want to know your name before we hand over the keys.