Blog

Gift Card API Provider Checklist: Delivery, Scheduling, and Safeguards

Written by Giftronaut | Sep 1, 2026

A business-ready gift card API should do more than create an order. It should provide scoped authentication, a live product catalog, recipient management, immediate and scheduled delivery, idempotency protection, order status, and webhooks for events that the application needs to reconcile.

Start with the integration outcome

Before comparing APIs, define the event that should trigger a reward and the evidence your application needs after the send. Common examples include survey completion, customer referral approval, sales milestones, research participation, and employee recognition.

The integration should answer four questions:

  • Who is allowed to create or cancel an order?
  • Which product, country, currency, and denomination should be used?
  • How and when should the recipient receive the reward?
  • Which status changes must be recorded in the source system?

The Giftronaut Developer Platform provides APIs for orders, recipients, recipient groups, catalogs, balances, campaigns, email templates, and webhooks.

Seven capabilities to verify

1. Scoped authentication

Use credentials and scopes that match the integration’s responsibilities. Giftronaut documents separate read and write scopes for orders, recipients, catalogs, balances, campaigns, templates, and webhooks.

2. Catalog lookup

Do not hard-code a product that may not be available in every country or currency. The integration should query the current branded-card or Choice Card catalog and store the selected product identifier with the order decision.

3. Immediate and scheduled delivery

Orders can be delivered immediately or scheduled. A scheduled order requires a delivery timestamp and time zone; an immediate order should not include scheduled-delivery fields.

4. Email and reward presentation

Confirm how sender name, subject, message, and reusable email templates are supplied. If the business distributes reward links through its own channel, confirm that the selected product and account support that delivery pattern before building around it.

5. Idempotency

Every order creation request should have a unique idempotency key. This prevents a network retry from creating a second funded order. Store the key with the source event so support and finance teams can trace the request.

6. Status and exception handling

The application should record the provider order ID and handle pending, scheduled, delivered, failed, cancelled, and resend-related states that apply to the selected endpoint. Do not treat an accepted API request as proof of final recipient delivery.

7. Webhooks and reconciliation

Use signed webhooks for timely updates and periodic reconciliation for missed events. Verify signature handling, retry behavior, event identifiers, and how duplicate webhook deliveries are detected.

A controlled implementation sequence

  1. Create a sandbox developer app.
  2. Request only the scopes required for the pilot.
  3. Query the current catalog instead of hard-coding products.
  4. Create a test recipient and email template.
  5. Place an order with a unique idempotency key.
  6. Record the provider response and order identifier.
  7. Test scheduled delivery, cancellation, and resend behavior where applicable.
  8. Validate webhook signatures and duplicate-event handling.
  9. Reconcile order and balance records before moving to production credentials.

Frequently asked questions

Can the API send rewards by email?

Yes. Giftronaut order requests include email settings such as sender name, subject, message, and an optional reusable template.

Can orders be scheduled?

Yes. The orders API documents scheduled delivery with an ISO-8601 timestamp and IANA time zone.

Is there a sandbox?

Teams can create a sandbox app to test the integration before requesting production credentials.

Can an API retry create duplicate funded orders?

It can if the integration does not protect against retries. Giftronaut requires an idempotency key for order creation and documents duplicate-request behavior.

Design for auditability before volume

The best provider is the one your team can operate safely: current catalog data, scoped access, deterministic order creation, and clear reconciliation. Start with the Giftronaut API quickstart and validate the complete sandbox path before enabling production sends.