Which Shopify Loyalty Apps Can an AI Agent Check Points and Tiers In? Smile.io, LoyaltyLion, Yotpo and 10 More (2026)

Which loyalty apps can an AI agent read and update, and how?

"Static key" means the merchant creates a credential once in the app's settings and the agent sends it in a header on every call: no shopper login, no token that expires in an hour. That's what an agent working tickets on its own needs. The last three columns list only what each vendor's API reference documents.

Ratings and review counts come from each app's Shopify App Store listing on 28 September 2026, except Friendbuy, whose listing we couldn't load that day (the figure is from our 25 September read). The 13 listings add up to 20,136 reviews; the 9 apps an agent can reach with a static key hold 15,407 of them, or 76.5%. Smile.io alone is 22.9%.

What do shoppers ask support about their points?

Loyalty tickets come in five shapes, and four of them are reads:

• "How many points do I have?" Before a sale, and more often during one.
• "Why didn't my order earn points?" Usually an unpaid, refunded or guest-checkout order.
• "What tier am I in, and what do I need for the next one?"
• "Where's my reward code?" The shopper redeemed points last month and lost the email.
• "Can you add the points I'm owed?" The one write, and the one that needs a rule.

Every app in the reachable nine returns the balance for the first question. The tier question needs a tier name and a threshold, and apps differ on whether one call gives both: Yotpo's customer record carries vip_tier_name and vip_tier_upgrade_requirements, Rivo's carries a vip_tier object with its threshold, and LoyaltyLion's carries a loyalty_tier_membership with the tier's bounds. The missing-points question usually means reading the order as well. Macha's built-in Shopify connector reads the order's financial status, so the agent can tell a shopper their points arrive when payment completes, without a loyalty call at all.

Matching the shopper by email

The help desk hands the agent an email address. Most loyalty APIs take it directly, and the differences are where agents go wrong:

• Exact lookups by email: Yotpo (customer_email), Stamped's Lookup Customer, Appstle's customer-loyalty and Joy's customer list with an email filter.
• Email or Shopify ID in the path: Rivo's customer_identifier takes either. Rivo's docs warn that a new customer can take 30 to 60 seconds to appear, because it waits on a Shopify webhook.
• Substring match: LoyaltyLion's GET /v2/customers returns "customers whose email contains the specified string". A search for [email protected] also returns [email protected]. The agent has to compare the returned email to the requester's, character for character, before it quotes a balance.
• Duplicates: Smile.io doesn't enforce unique emails, so one address can return two records. The Smile.io page covers that trap in detail.

A wrong match here means the agent tells one shopper another shopper's balance, which is a privacy problem as well as a wrong answer.

Which apps can change points or tiers?

Eight of the nine reachable apps document a points write, and Rise.ai documents a store-credit write in place of points. The endpoints differ in useful ways. LoyaltyLion's Add Points accepts 1 to 1,000,000 points and a reason that's "visible to the shopper". Joy splits the job into award, deduct and adjust. Rivo creates a "points event" that can add or subtract. Gameball calls it a manual transaction and requires the SecretKey header on top of the APIKey for it.

Tier changes are where the apps split. Stamped's Adjust VIP Tier takes the tier's name as an exact match. Rivo's update_vip_tier takes a tier ID, an internal_note the customer won't see and a skip_email flag that suppresses the tier-change email. Joy has PUT /customers/{customerId}/tier. Yotpo added an endpoint in November 2023 that removes a customer from an action-based tier, which is a downgrade rather than an upgrade. Smile.io has no tier endpoint at all, and LoyaltyLion's case is unclear. Its write_customers scope says it can "change tiers", but its API reference index lists no tier endpoint, so we treat it as not documented.

Where a tier endpoint exists, keep it out of an agent's hands unless you've written the rule for it. A tier is a promise of future discounts. Moving a shopper up is a commercial decision, and Rivo's skip_email flag is there if you don't want the shopper emailed about it.

Which loyalty apps are plan-gated?

Three of the nine reachable apps charge for API access, and the gate is steep in two of them:

At the other end, Yotpo's help center lists the loyalty API key and GUID under "Free, Pro, Premium, Enterprise", and Rivo's pricing page lists its REST API under what "comes included on every plan". LoyaltyLion's pricing page, which starts at $199 a month for 500 orders, doesn't mention API access as a plan feature, and its docs let any account create keys under Manage, API keys.

The incentive behind the gates is the same in every case. Several also offer a partner route: Smile.io and LoyaltyLion recommend OAuth for partners, and Appstle says its partner tokens "bypass the paid API plan". A listed integration keeps the vendor in control of what third parties can do and costs the merchant nothing extra. A raw merchant key lets the merchant wire the program into anything, including tools the vendor never reviewed, and the vendors price that freedom at their top tiers. Joy moved every endpoint to Ultimate in September 2025, which ties the API to its most expensive listed plan.

Which loyalty apps can't an AI agent reach?

Four, for four different reasons:

• BON Loyalty (5.0 from 1,937 reviews, the third most-reviewed app here) doesn't publish an API reference. Its App Store pricing card for the $129 Growth plan ends with "PING US FOR ENTERPRISE PLAN (API, SDK..)". Until a merchant gets that plan and its docs, an agent can answer policy questions and hand the rest to a person.
• Growave documents API 2.0 "starting from Plus plan", with endpoints to read pointsBalance, get tier progress and update a balance. Auth is the problem. The client ID and secret are exchanged for a "temporary access token" with an expiresAt. A tool that sends a fixed header stops working when that token expires. On 28 September 2026, docs.growave.io's reference pages were redirecting to an expired-referral page, so we read the API from the Internet Archive's copy dated 17 May 2026.
• ReferralCandy signs every request: the secret key is prepended to the sorted parameters and a timestamp, then MD5-hashed. The signature changes on every call, which a fixed header can't do. It also has no points balance to read; it's a referral program with cash and coupon rewards.
• Friendbuy exchanges a key and secret at POST /authorization for a bearer token with an expiration date. It does have a loyalty ledger with balance reads and adjustments, so it's the most capable of the four, but the expiring token rules it out for a fixed-credential tool today.

Planning notes we wrote on 25 September said Growave was "OAuth PKCE only". The API page describes a client-credentials exchange instead. The practical answer is the same: not feasible with a static key today.

What does the help desk's own integration already do?

Before building anything, check what your help desk already shows. On Gorgias, the apps directory has listings for Smile, LoyaltyLion, Rivo, Growave, Rise.ai and Yotpo. Most of them display loyalty data beside the ticket: Smile's shows the profile, puts the balance or referral URL into macros and triages by VIP tier, and Growave's shows loyalty points, referred members and VIP tier. Rise.ai goes further: its Gorgias listing says "Support teams can issue store credit directly from tickets." On Zendesk, LoyaltyLion's integration shows tier, birthday, points balance and rewards claimed, and lets agents "Gift points". The Gorgias integrations roundup and the Yotpo and Gorgias setup guide cover the Gorgias side.

That covers the human agent. What those integrations don't do is answer the ticket: a person still reads the sidebar, checks the order and types the reply. An AI agent adds the reply and, where your rules allow, the capped goodwill write, using the same API the sidebar reads from.

What stays with a person, and the instruction we tested

• Tier upgrades and downgrades. Even where Stamped, Rivo and Joy allow it, a tier move changes what a shopper gets for months.
• Points above your goodwill cap. Points are a liability on the merchant's books; an agent that adds 5,000 points has issued a discount. Set a maximum in the instructions and hand off above it.
• Deductions. Taking points back after a refund is correct and still reads as hostile. A person should word it.
• Duplicate or near-match records. Any lookup that returns more than one customer, or a LoyaltyLion match that isn't exact.
• Anything on BON, Growave, ReferralCandy or Friendbuy that needs account data, until those APIs are reachable.

Here's the agent instruction we wrote for a LoyaltyLion store and then ran on a test ticket:

When a customer asks about points, rewards or their tier, search LoyaltyLion customers by the requester's email. Use only a result whose email matches the requester's exactly; if none matches, say you can't find a rewards account under that email and ask which email they used at checkout. For balance questions, quote points_approved, and mention points_pending only if it's above zero ("pending points confirm once the order is paid"). For tier questions, give the tier name from loyalty_tier_membership. For missing points on an order, look up the order in Shopify first: if it isn't paid, explain that points arrive when payment completes. If it's paid and the customer has no activity for it, add the points that order should have earned with reason "Points for order #<number>", up to 500 points. Above 500, or for any tier change or deduction, add an internal note and hand off.

The 500-point cap is a placeholder; set it from your own program. The rest of the per-app detail lives on the app pages: Smile.io for Plus-plan keys and missing-points causes, and Yotpo's own page (coming in this series) for the two-header loyalty key and why its reviews side is a different story.

Our test run on a made-up LoyaltyLion ticket

We built that agent on Macha Demo, our own demo workspace, on 28 September 2026. It has two custom tools: "T4-134 LoyaltyLion: Find customer by email", a GET to https://api.loyaltylion.com/v2/customers?email= marked Read, and "T4-134 LoyaltyLion: Add points", a POST to /v2/customers/{merchant_id}/points marked Write. We don't have a LoyaltyLion account, so both carry a dummy pat_ key. The tool editor's Run Test sent the lookup to LoyaltyLion's live API and got HTTP 401 with "Invalid API key" back. That proves the host, path and Bearer header reach LoyaltyLion, and nothing more. The email travels in the URL, as a placeholder after ?email=; the parameter's location in the screenshot reads Body, so if you copy this tool, set it to the query string instead.

The agent got the instruction above pasted verbatim and six attached tools: two Shopify order tools (Search Orders and Get Order), Zendesk's Get Ticket and Add Internal Note, and the two LoyaltyLion tools. We left it inactive and sent it a made-up ticket in the dashboard's "Try it" chat: #1140 on our Zendesk sandbox, from "Maya Test", asking "How many points do I have? And am I close to Gold?"

One thing to know before the steps. That chat offers the agent every tool on the workspace, not only the ones attached to it; the agent's Test run uses only its attached tools. We ran chat, not a Test run, so several of the calls below used tools this agent doesn't have. Here's what it did:

• It read the ticket, called the LoyaltyLion lookup and got the 401. It never quoted a balance or a tier.
• It also called a Smile.io lookup tool from an earlier test on the same workspace. That failed with a 401 too.
• The instruction said nothing about a failed lookup, so the agent went looking for the Gold threshold elsewhere: 11 knowledge searches, 3 Notion searches and a help center search, 23 tool calls in the first turn.
• The conversation record also shows a Shopify customer lookup and an attempted ticket-status update that was paused and skipped, and the agent tried to send Maya a public reply saying it couldn't check her rewards yet. Zendesk replies are a built-in write, so the chat paused on a confirmation card. We rejected the reply and confirmed the internal note that came next.

The gap was in our instruction. It covered a missing account and a near-match, not an API that's down or a key that's been revoked, which is what a rotated key or a downgraded plan looks like to the agent. We added one sentence: "If the LoyaltyLion lookup fails or returns an error, don't search anywhere else for balances or tier thresholds: add an internal note with the error and hand off without replying to the customer." On a second run of the same ticket, the first turn made 12 tool calls instead of 23, and the internal note quoted the 401 and said no reply had been sent. In chat it still reached for a public reply once before that, and the card stopped it. That reply tool isn't attached to this agent, so in a Test run, which uses only attached tools, it can't send one at all; we didn't run a triggered run, but it uses the same attached tool list. The tool list is the hard limit and the instruction is the soft one: attach only what the agent should use, and judge a rule like "don't reply" from a Test run, which sees the same tools the live agent will. We didn't repeat the ticket as a Test run, so we can't say how many of the 23 calls it would have made there. The Add points tool never ran, because the lookup failed first, so this test tells you nothing about the write.

Where does Macha fit?

None of these loyalty apps has a built-in Macha connector. Each of the nine with a static key connects through a custom API tool that Macha's team sets up during onboarding, using the app's own auth: a Bearer key for Smile.io and LoyaltyLion, a bare Authorization header for Rivo, and two fixed headers for Yotpo Loyalty, Joy, Rise.ai and Gameball. Custom tools can send several fixed headers, and they're included on every plan. Read tools come first (customer lookup, transaction history, tiers); the points write is marked Write. Don't rely on a confirmation card to catch a bad points write. In our dashboard tests on 28 September, built-in Zendesk writes paused for a card, but a custom Write tool that adds Smile.io points ran without one (the Smile.io page shows that run), and on a triggered run a Write tool runs directly when the instructions say to. The cap and the handoff rules belong in the agent's instructions. The custom tools docs and our custom API tools guide show how a tool is defined.

The rest of the ticket runs on built-in connectors: Shopify for the order and customer, and the help desk connector that posts the reply on Zendesk, Freshdesk, Gorgias, Front, HubSpot or Intercom. Macha fits teams on one of those desks, running one of the nine reachable loyalty apps on a plan that includes API access, who want "where are my points" answered and fixed inside the ticket rather than read off a sidebar. It's the wrong choice if you're on BON, Growave, ReferralCandy or Friendbuy, or below Smile.io's Plus plan: there's no fixed key to connect, and a person with the loyalty admin open is the honest answer. It's priced per ticket from $299/month for 750 tickets (see pricing), so the three or four loyalty calls in a missing-points ticket don't change the charge. For the rest of the Shopify stack, see which Shopify apps an AI agent can work with and the subscription apps matrix.

Frequently asked questions

Which Shopify loyalty apps have an API an AI agent can use? Smile.io, LoyaltyLion, Yotpo Loyalty, Stamped, Joy, Rivo, Appstle Loyalty, Rise.ai and Gameball document APIs that take a static key. Smile.io, Joy and Appstle require a paid plan or API plan for that access.

Can an AI agent check a customer's loyalty points balance? Yes, in those nine apps. Each returns the balance from a customer lookup by email or Shopify customer ID; Rise.ai returns a store-credit balance instead of points.

Can an AI agent change a customer's VIP tier? Only in Stamped, Rivo and Joy, which document a tier-change endpoint. Yotpo's API can remove a customer from an action-based tier, Smile.io's has no tier endpoint, and LoyaltyLion's reference lists none.

Which loyalty app is the cheapest to connect to an AI agent? By plan gate, Yotpo Loyalty lists API credentials on all plans including Free, and Rivo lists its REST API on every plan. Smile.io needs Plus at $999 a month and Joy needs Ultimate at $499 a month.

Does BON Loyalty have an API? Not publicly. BON's Shopify App Store pricing says to contact it for an Enterprise plan that includes API and SDK access, and no API reference is published.

Why can't an AI agent use Growave, ReferralCandy or Friendbuy? Growave and Friendbuy issue tokens that expire, and ReferralCandy requires a new MD5 signature on every request. A tool that sends a fixed key can't keep up with either.

How we researched this

On 28 September 2026 we read the API reference, authentication page and any plan note for each of the 13 apps on the vendor's own site; the links are in the first table. Growave's docs domain was redirecting that day, so its API page was read from the Internet Archive snapshot of 17 May 2026. Plan prices come from the vendors' pricing pages (Joy, LoyaltyLion, Stamped, Rivo), BON's Shopify App Store listing, and Smile.io's pricing page as read for our Smile.io page the same day. A "No endpoint" or "Not found" cell means the vendor's reference index had none; "Not stated" means the docs we read didn't mention a plan gate. Ratings and review counts are each app's Shopify App Store listing on 28 September 2026, read from the listing's structured data; Friendbuy's is from 25 September. Arithmetic: the 13 review counts sum to 20,136; the nine static-key apps sum to 15,407, and 15,407 divided by 20,136 is 76.5%; Smile.io's 4,610 divided by 20,136 is 22.9%. To check the auth shapes, we called a read endpoint on eight of the APIs with dummy credentials: LoyaltyLion, Yotpo, Joy, Rivo, Appstle, Smile.io and Gameball answered HTTP 401 and Rise.ai HTTP 403, which confirms the host, path and header names reach the vendor. We didn't have live loyalty accounts, so no customer data was read and every write described here is documented, not tested. The worked example ran on 28 September 2026 on Macha Demo, our own demo workspace: two LoyaltyLion custom tools with a dummy key, an inactive agent, and a made-up ticket (#1140, requester "Maya Test", [email protected]) on our Zendesk sandbox. Our sandbox's webhooks don't reach the production agent, so we ran the agent in the dashboard's "Try it" chat on the same ticket rather than through a trigger. That chat offers every tool on the workspace, while a Test run uses only the agent's six attached tools; we used chat only, which is why the Smile.io, Notion, help center, Shopify customer, public reply and status calls appear. Step counts come from the chat's tool panel and the conversation record: 23 tool calls in the first turn of run one, 12 in run two after the added sentence. The agent instruction, the shopper and ticket #1140 are synthetic. To try an agent on your own help desk, start a trial with $50 of free usage (about 125 tickets), no credit card, no time limit, and ask the Macha team to build your loyalty app's tools during onboarding.