Skip to main content
POST
Generate Auth Token
Loyalife uses OAuth 2.0 client credentials flow for API authentication. This endpoint exchanges your client_id and client_secret for a JWT bearer token valid for 30 minutes (configurable). Every subsequent API call must include this token in the Authorization header — there is no session or cookie-based alternative. Cache the token and reuse it; never generate a new token per request.
Credentials are per-program. Find your client_id and client_secret in Loyalife Admin under Configurations → Program Settings → API. Regenerating credentials immediately invalidates all previously issued tokens.

Responses


Error Codes

Body

application/json
grant_type
enum<string>
required

OAuth 2.0 grant type

Available options:
client_credentials
Example:

"client_credentials"

client_id
string
required

Your OAuth client ID from Loyalife Admin → Program Configuration → API

Example:

"your-client-id"

client_secret
string
required

Your OAuth client secret. Never expose in client-side code.

Example:

"your-client-secret"

scope
string

Optional. Binds token to a specific member. JSON-encoded array: ["LOGIN","{RelationReference}"]. Omit for a general-purpose program token.

Example:

"[\"LOGIN\",\"jane.doe@example.com\"]"

Response

Token issued

results
object