Member feed and REST API

Two options

Both are read-only. Nothing you connect can change your stamps, customers or rewards.

Both are owner-only and part of the Growth plan. The reference documentation stays readable on any plan, so you can see exactly what you would be getting before upgrading.

The spreadsheet feed

One link that returns your member list. Turn it on in Settings, then Integrations.

You get a CSV link and a JSON link, plus a ready-made formula to paste into Google Sheets so the sheet keeps itself up to date.

The columns are deliberately minimal:

• name and email
• member since
• how many of your cards they hold
• lifetime stamps
• their health segment

Rows are one per person, not per card.

The link is the password

There is no separate password on the feed. Anyone holding the link can read your member list, because spreadsheet tools cannot send a password alongside a request.

Treat it accordingly:

• only paste it into tools you trust
• do not put it in a shared document or a public sheet
• rotate it if you are unsure who has it

Rotating replaces the link immediately, so the old one stops working at once. It also resets the usage counters, so a dead link never looks active.

The usage panel shows when it was last read and from where, which is the fastest way to spot a link being used somewhere you did not expect.

The feed allows one refresh per minute and returns up to 5,000 members. It is a lookup aid, not a full copy of your database.

The REST API

For connecting another system. Three read-only endpoints:

• verify a key and see which business it belongs to
• look up whether an email address is a member
• list members, a page at a time

Create a key in the API keys tab. The key is shown once. Only a fingerprint is stored, so it cannot be shown again, so copy it into your system straight away.

You can hold up to ten live keys. Give each one a label naming what uses it, so you can revoke a single integration later without breaking the others.

Keys are revoked, never deleted. A revoked key keeps its label and last-used time so you can still see what it was, and it can never be brought back.

The limit is 60 requests per key per minute.

Looking someone up

The lookup endpoint is the one most integrations want. Give it an email address and it tells you whether that person is a member, with their stamp progress.

Prefer it over listing everyone. The list is paginated over cards, so someone holding two of your cards can appear on two pages. That is fine for a one-off export and awkward for a live lookup.

If your plan lapses

The feed and API stop returning data, and callers are told plainly why. Nothing is deleted, and everything starts working again the moment you resubscribe.

You can always revoke a key or turn off a feed, whatever your plan. A credential that is live in someone else's system must never become un-revokable.