Developers

Connect to every reward rail in one call.

TruPoints is a super-aggregator. One integration, and your loyalty program can earn, lock, switch and burn across FreeByte, Reloadly, SA telcos and retail vouchers — without writing a line of code per rail.

Supported rail IDs

freebyte.airtimeFreeByte airtime · EMEA

freebyte.dataFreeByte data · EMEA

reloadly.giftcardReloadly gift cards · 140+ countries

reloadly.airtimeReloadly airtime · 150+ countries

reloadly.dataReloadly data bundles · global

reloadly.payoutReloadly Perq payout links

reloadly.cardReloadly virtual money cards

satelco.airtimeSA telcos · Voda / MTN / Tel / CC

retail.voucherRetail vouchers · Shoprite / PnP / Takealot

Burn endpoint

POST /v1/burn

Burn member value to any supported rail. Idempotent. Returns provider-native transaction ID + audit hash.

{
  "member_id": "mem_01HF...",
  "amount_zar": 50.00,
  "rail": "reloadly.giftcard",
  "rail_options": {
    "product_id": "shoprite_zar",
    "denomination": 50
  },
  "idempotency_key": "burn_2026_06_05_xyz"
}

Lock endpoint

POST /v1/transaction/lock

Move member value into regulated escrow with a date or rule-based unlock. Powers stokvel pots, birthday rewards and save-to-burn programmes.

{
  "member_id": "mem_01HF...",
  "amount_zar": 200.00,
  "unlock_at": "2026-12-15T00:00:00Z",
  "allowed_rails": ["retail.voucher", "satelco.airtime", "reloadly.giftcard"]
}

Webhooks

Signed events

All outbound events are HMAC-SHA256 signed. Verify before processing — never trust the payload.

// Verify HMAC-SHA256 signature
const expected = createHmac('sha256', process.env.TP_WEBHOOK_SECRET)
  .update(rawBody).digest('hex');
if (!timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
  return new Response('Invalid signature', { status: 401 });
}

OpenAPI

Full spec

The full openapi.json ships once the JV closes and sandbox keys are issued. Email devs@trupoints.co.za for early access.