vxn_test_sk_...) if you would rather run it away from real customers first (see Testing and environments).
Anatomy of your first call
Every step below is the same four-beat pattern: grab your key once, put it on every request, call an endpoint, read what comes back. Once this loop feels automatic, the rest of the API is just new endpoints inside it.1
Find your card id
id of your stamp card (crd_...) from the response.2
Enroll a customer
POST /v1/customers is an upsert - the same call from your checkout can run on every order, and the dedupe key (external_id → email → phone, scoped to the card) makes it idempotent:claim_url. Send it to the customer yourself, or add "deliver": { "channel": "email" } to the request and we email it. When the customer opens the link, the pass lands in their Apple or Google Wallet.Good to know: if the business has Dotykačka connected and customer sync is on, a customer created through
POST /v1/customers (or the MCP create_customer tool) appears in Dotykačka within about 5 minutes, the same way as a customer who signs up through the card. Only the card types that the Dotykačka integration syncs are sent. VEXiON matches by its own customer id, so a person that staff already created directly in Dotykačka gets a second record there. A later change of the name, email, phone or birthday through the API goes to Dotykačka the same way. If the business has Papaya connected, the customer is also added to Papaya, and a change of name or email reaches Papaya too. A new customer with an email or phone that is not valid gets that field left empty in Dotykačka. For a customer Dotykačka already has, a valid value goes to Dotykačka; an email or phone that is not valid is not sent, and Dotykačka keeps the value it has.3
Award a stamp
type: "stamp.add" and balance_after.stamps_collected. Once the customer has added the pass, it updates and their lock screen shows the banner.4
Hear about it (optional)
Register a webhook receiver and prove it in one call:
Where next
Transactions
Every loyalty event, one endpoint.
Webhooks
Signatures, retries, the 22-event catalog.
Testing and environments
The sandbox, and how to go live.
Idempotency
Why every POST carries the key.