Skip to main content
Where to find this: API key generation — Shopify admin → Apps → Yuko Loyalty → Integrations → REST API.
Reference: API Reference.

​
What you can do

The Yuko REST API exposes the same data the dashboard shows:
  • List and retrieve customers and their points balances, tiers, memberships and rewards.
  • Redeem rewards and add or deduct points.
  • List rewards, VIP tiers, earning rules, booster campaigns and the referral program.
  • Read activity feeds, points transactions and referrals.
  • Estimate the points a cart will earn at checkout.
Full endpoint reference is in the API Reference tab — this page covers setup and best practices.

​
When to use

  • Custom storefronts (Hydrogen, headless).
  • Server-side automations that need to read or write Yuko data.
  • Moving points balances over from another loyalty program (customers must already exist in Yuko; they’re synced from your store automatically).
  • Building admin tools that show Yuko data alongside your other systems.

​
Before you start

Yuko app is installed on your Shopify store — see Install Yuko on Shopify.
The Yuko Theme App Embed is enabled in your active theme — see Theme App Embed.
Your loyalty program is enabled under Loyalty Program Status at Shopify admin → Apps → Yuko Loyalty → Loyalty → Programs.
Your point labels are set in Loyalty Settings.

​
Setup

1

Open REST API settings

Go to Apps → Yuko Loyalty → Integrations → REST API and click Create new key.
2

Name the key

Enter a Private API Key Name (for example, Marketing Integration) so you can tell your keys apart.
3

Choose the access level

Under Select Access Level, pick one:
  • Full Access Key: read and write access for every API scope.
  • Read-Only Key: read-only access for every API scope.
  • Custom Key: click Next, then on the Customize API Scopes screen set each scope to No Access, Read Access or Read/Write Access.
4

Create and copy the key

Click Create (or Create API Key for a custom key). The Your Private Key popup shows the key, which starts with py_. Copy it to a password manager or secrets store.
5

Authenticate requests

Send the key as a Bearer token in the Authorization header. Details: Authentication.

​
Managing keys

The API keys list shows each key’s name, masked token (use Show token or Copy token to see or copy the full key), status, scopes, when it was last used, and when it expires or was revoked. You can search by token name. To revoke a key, use the Actions column and confirm in the Revoke API key dialog. Any integration using the key loses access immediately, and this can’t be undone.

​
Authentication and scopes

All requests use Bearer token authentication. Each key only works for the scopes it was given; a request outside them returns 403 insufficient_scope. See Authentication and Scopes.

​
Pagination, errors, rate limits

​
Best practices

Give each key only the scopes it needs. Use a Custom Key instead of full access where you can.
Rotate API keys regularly and immediately when a developer leaves: create a new key, switch your integration to it, then revoke the old one.
Cache configuration data such as rewards, VIP tiers and earning rules instead of fetching it on every request. It rarely changes, and caching keeps you well under the rate limit.
Tag every key with a name so you can revoke a single integration without breaking others.

​
FAQs

Strongly recommended. It limits blast radius if one is leaked.
Yes. In Integrations → REST API, use Show token or Copy token on the key in the API keys list. If you think a key has leaked, create a new key and revoke the old one.
See Rate Limits in the API Reference.
Yes. In Integrations → REST API, use the Actions column on the key and confirm Revoke. Revocation is immediate and can’t be undone.

REST API

Read and write Yuko data programmatically.

Webhooks

Receive real-time event notifications.

Shopify Flow

Trigger Shopify Flow workflows from Yuko loyalty, VIP and referral events.

Shopify POS

Redeem points and apply loyalty discounts at the till.

Klaviyo

Sync customers, points and tier data into Klaviyo.

Omnisend

Sync loyalty data into Omnisend.

WhatsApp

Send transactional loyalty messages via 13 supported WhatsApp Business API providers.

Retainful

Email marketing & abandoned cart recovery.

Judge.me

Award loyalty points for Judge.me reviews.

Book a Free Setup Call

Talk to our team for personalised setup help.Time: 30 minutes

Contact Support

Visit our support hub for help articles, live chat and ticket submission.

Browse the Guides

Documentation across loyalty, referrals, memberships and more.

Install Yuko

Add Yuko to your Shopify store from the Shopify App Store.