---
title: Support loyalty and HMAC integrations
description: Diagnose loyalty OAuth errors, partner hook failures, HMAC signature mismatches, and gift-card business declines, with status codes and retry guidance.
---
[Skip to content](https://knowledge.impos.com.au/support-loyalty-and-hmac-integrations#main-content)
English - Australia
Show submenu for translations
[More support](https://knowledge.impos.com.au/kb-tickets/new?hsLang=en-au)
[](https://impos.com.au)
Open main navigation
Close main navigation
- English - Australia
Show submenu for translations
- [More support](https://knowledge.impos.com.au/kb-tickets/new)
- [visit impos.com.au](https://impos.com.au/)
[visit impos.com.au](https://impos.com.au/)
How can we help you?
- There are no suggestions because the search field is empty.
1. [Impos Knowledge Base](https://knowledge.impos.com.au/?hsLang=en-au)
2. [Cloud Based Management](https://knowledge.impos.com.au/cloud-based-management?hsLang=en-au)
3. [Impos Cloud API](https://knowledge.impos.com.au/cloud-based-management?hsLang=en-au#impos-cloud-api)
18 October 2026
# Support loyalty and HMAC integrations
## Diagnose loyalty OAuth, partner hooks, HMAC, and business responses
Start by establishing direction.
1\. Partner/POS → Impos Loyalty
OAuth bearer authentication
2\. Impos Loyalty → partner hook
HMAC authentication
OAuth-side triage
For `401`, verify realm, service audience, expiry, and explicit `impos-cloud-loyalty` scope. For `403`, verify the permission and organisation/site binding. A cross-organisation or cross-partner ownership mismatch can deliberately return `404`.
All Loyalty domain errors use RFC 7807 `application/problem+json`. Capture `traceId`. In broad terms:
| Status | Meaning |
| --- | --- |
| 400 | Request or program/hook configuration. |
| 401 | Bearer token or required loyalty scope. |
| 403 | Permission denied. |
| 404 | Missing or ownership-hidden resource. |
| 409 | Conflict or applicable business rejection. |
| 502 | Core/partner unavailable, or partner response cannot satisfy the contract. |
| 504 | Partner call exceeded the ten-second timeout. |
Gift-card partner business declines are different: the partner can return HTTP `200` with `success: false`, `errorCode`, and `message`.
**HMAC mismatch checklist**
Ask the partner to reproduce with synthetic or redacted data and confirm:
1. Ask the partner to confirm locally that it selected the credential for the correct organisation and environment. Never ask it to disclose the secret.
2. Uppercase HTTP method.
3. Exact path and query, including order and percent-encoding.
4. Unix timestamp in seconds, within 300 seconds of partner server time.
5. SHA-256 over raw body bytes, before JSON parsing.
6. Line feeds (`\n`), not carriage-return line feeds.
7. Lowercase hexadecimal body hash and signature.
8. Constant-time signature comparison.
Use the fixed vector in the external HMAC article to test their implementation independently of live credentials. Never ask for the live secret. If Impos and the partner calculate different signatures over allegedly identical requests, compare the captured byte length and lowercase body hash before comparing JSON objects.
**Partner identifier confusion**
Member enquiry/search/enrolment and cashback operations can use different identifiers as the partner linkage is established. Cashback and reversal prefer the stored `partnerMemberId` where available. If a partner reports the “wrong card ID,” inspect the program member's linkage and the precise operation before changing data.
**Money-operation retries**
Loyalty ledger reversals are compensating entries, not edits. The current contract does not provide universal deduplication for every money operation, so do not advise blind replay after a timeout. First determine whether the partner or Impos applied the original operation, using `transactionRef`, `partnerReference`, and ledger/delivery evidence.
**Credential lifecycle**
HMAC credentials are scoped to a partner and organisation and can be shared across that partner's programs in the organisation. The secret is returned only at creation or rotation. Store and transmit it only through approved secret channels; record lifecycle events without the value.
- [How to Connect to your Venue Remotely](https://knowledge.impos.com.au/how-to-connect-to-your-venue-remotely?hsLang=en-au#main-content)
- [How to Connect to your Venue Remotely](https://knowledge.impos.com.au/how-to-connect-to-your-venue-remotely?hsLang=en-au#how-to-connect-to-your-venue-remotely)
- [Impos Back Office and Stock](https://knowledge.impos.com.au/impos-back-office-and-stock?hsLang=en-au#main-content)
- [Stock](https://knowledge.impos.com.au/impos-back-office-and-stock?hsLang=en-au#stock)
- [Back Office](https://knowledge.impos.com.au/impos-back-office-and-stock?hsLang=en-au#back-office)
- [Impos Front Office](https://knowledge.impos.com.au/impos-front-office?hsLang=en-au#main-content)
- [Cashier Reports](https://knowledge.impos.com.au/impos-front-office?hsLang=en-au#cashier-reports)
- [Getting Started with Impos Front Office](https://knowledge.impos.com.au/impos-front-office?hsLang=en-au#getting-started-with-impos-front-office)
- [Order Information](https://knowledge.impos.com.au/impos-front-office?hsLang=en-au#order-information)
- [Table Service](https://knowledge.impos.com.au/impos-front-office?hsLang=en-au#table-service)
- [Storing Order information in Front Office](https://knowledge.impos.com.au/impos-front-office?hsLang=en-au#storing-order-information-in-front-office)
- [Taking Payment](https://knowledge.impos.com.au/impos-front-office?hsLang=en-au#taking-payment)
- [Web Reports](https://knowledge.impos.com.au/impos-front-office?hsLang=en-au#web-reports)
- [More Functions](https://knowledge.impos.com.au/impos-front-office?hsLang=en-au#more-functions)
- [Impos Analytics](https://knowledge.impos.com.au/impos-analytics?hsLang=en-au#main-content)
- [Impos Analytics](https://knowledge.impos.com.au/impos-analytics?hsLang=en-au#impos-analytics)
- [Integrations](https://knowledge.impos.com.au/integrations?hsLang=en-au#main-content)
- [Doshii](https://knowledge.impos.com.au/integrations?hsLang=en-au#doshii)
- [Kitchen & Inventory Management](https://knowledge.impos.com.au/integrations?hsLang=en-au#kitchen-inventory-management)
- [Reservations & Room Charge](https://knowledge.impos.com.au/integrations?hsLang=en-au#reservations-room-charge)
- [Deputy Rostering](https://knowledge.impos.com.au/integrations?hsLang=en-au#deputy-rostering)
- [Promotions & Membership](https://knowledge.impos.com.au/integrations?hsLang=en-au#promotions-membership)
- [Bump Screens](https://knowledge.impos.com.au/integrations?hsLang=en-au#bump-screens)
- [Accounting](https://knowledge.impos.com.au/integrations?hsLang=en-au#accounting)
- [EFTPOS](https://knowledge.impos.com.au/integrations?hsLang=en-au#eftpos)
- [Cinch](https://knowledge.impos.com.au/cinch?hsLang=en-au#main-content)
- [Cinch Web Publishing](https://knowledge.impos.com.au/cinch?hsLang=en-au#cinch-web-publishing)
- [Cinch Basics](https://knowledge.impos.com.au/cinch?hsLang=en-au#cinch-basics)
- [Kiosk](https://knowledge.impos.com.au/kiosk?hsLang=en-au#main-content)
- [Setting Up Kiosk](https://knowledge.impos.com.au/kiosk?hsLang=en-au#setting-up-kiosk)
- [Latest Updates](https://knowledge.impos.com.au/latest-updates?hsLang=en-au#main-content)
- [Release Notes](https://knowledge.impos.com.au/latest-updates?hsLang=en-au#release-notes)
- [Policy Updates](https://knowledge.impos.com.au/latest-updates?hsLang=en-au#policy-updates)
- [FAQs](https://knowledge.impos.com.au/faqs?hsLang=en-au#main-content)
- [FAQs - Front Office](https://knowledge.impos.com.au/faqs?hsLang=en-au#faqs-front-office)
- [FAQs - Back Office](https://knowledge.impos.com.au/faqs?hsLang=en-au#faqs-back-office)
- [FAQs - Hardware eg Printers, Terminals, Tablets, Networking](https://knowledge.impos.com.au/faqs?hsLang=en-au#faqs-hardware-eg-printers-terminals-tablets-networking)
- [FAQs - Onboarding, Installation and Training](https://knowledge.impos.com.au/faqs?hsLang=en-au#faqs-onboarding-installation-and-training)
- [FAQs - Stock](https://knowledge.impos.com.au/faqs?hsLang=en-au#faqs-stock)
- [FAQs - Schools](https://knowledge.impos.com.au/faqs?hsLang=en-au#faqs-schools)
- [Cloud Based Management](https://knowledge.impos.com.au/cloud-based-management?hsLang=en-au#main-content)
- [Impos Cloud API](https://knowledge.impos.com.au/cloud-based-management?hsLang=en-au#impos-cloud-api)
- [Troubleshooting](https://knowledge.impos.com.au/troubleshooting?hsLang=en-au)
[](https://impos.com.au/)
[mailto:email@email.com](mailto:email@email.com)
Copyright © 2026, Impos