Authentication
Send your secret key as a bearer token. A key only ever sees your own drops.
curl https://api.rewardics.com/v1/drops \ -H "Authorization: Bearer sk_live_4Xa9…" \ -H "Idempotency-Key: evt_88213"
Server side only. Rotate from the dashboard, two keys can be live during a switch.
Pass your own event ID so a retry can't send two rewards.
Claim status lifecycle
A drop only moves forward. Nothing that ends at expired gets invoiced.
/v1/drops
Creates a drop and gives you back a claim link on your subdomain. Either the recipient picks from a catalog, or you set the item and the page only asks for an address.
/v1/drops/:id
Returns the status, the claimed item, tracking and the delivery record once it's signed.
List with GET /v1/drops?status=shipped&created_after=… for lists. Cursor paginated, 100 per page.
Webhook events
Signed with HMAC-SHA256 over the raw body in the Rewardics-Signature header. We retry for 24 hours. Answer 2xx within 5 seconds.
Rate limits & errors
Ask us and we'll raise it. Limits report in X-RateLimit-Remaining; a 429 includes Retry-After.
{
"error": {
"type": "invalid_request",
"code": "catalog_unavailable_in_country",
"message": "tier_diamond_eu cannot ship to BR.",
"param": "catalog"
}
}Sandbox drops run the whole lifecycle on a fast clock, so you can test webhooks in minutes.