Key Features
The key features of Punchh x Lunchbox integration are: Single Sign-On (SSO), Earning Rewards, Rewards Redemption, Payments, and Delivery
Single Sign-On (SSO)
Lunchbox’s integration with Punchh SSO allows customers to use a single set of credentials to access both systems, eliminating the need to maintain multiple accounts. Here's how it works:
When a user signs up or logs in through Lunchbox ordering platforms, their record is simultaneously created in Punchh (and vice versa)
Upon login, Lunchbox sends the credentials to Punchh. If valid, Punchh returns a token.
This token:
Authenticates the user
Enables Lunchbox to access wallet and reward data
Remains valid for ~2 weeks and refreshes automatically two days before expiration or upon a new login session
IMPORTANT NOTE: There is no visible indication on the ordering platforms that the login is managed via Punchh. Also, the user experience remains fully native to Lunchbox.
Earning Rewards
Registered users can earn Punchh loyalty points when logged in and placing an order through any Lunchbox ordering platform (web or app) with the client who uses Punchh.
When a user completes a loyalty transaction (order status must be "Complete"), Lunchbox sends Punchh the following details about the transaction:
Customer Information - Fetch Account Balance of User
Product Mix - The assortment of different items the guest purchased.
Subtotal - The total cost of selected items.
Service Charges - Additional fees applied to cover services.
Tender - Form of payment accepted by the merchant.
Lunchbox will update Punchh if any changes are made to the transaction (i.e order modifications, cancellations, etc)
Rewards Redemption
When a signed-in user places an order, they can apply the following Punchh offers:
Coupon codes - One-time discounts for specific purchases
Promo codes - Campaign-specific offers (e.g., tied to a holiday or event)
Banked Points - Earned over time and stored until a perk is claimed
Rewards - Earned though moving to next level tiers or points conversion
IMPORTANT NOTE: Lunchbox allows stacking multiple offers per order or item. If an order is canceled, offers are returned to the guest’s Punchh account.
Payments and Delivery
As mentioned above, the user experience remains fully native to Lunchbox:
The Punchh integration allows users registered with Punchh or also users registered via chain's ordering platform to securely save and store their credit card information for future transactions.
When placing an order, user can choose between immediate (ASAP) or specify a desired time for order-ahead scenarios.
Additionally, our integration supports dispatch, delivery, and curbside pickup options.
Users can also choose to use the following payment options:
Apple Pay
Apple Wallet
E-gift cards
Physical gift cards
Limitations
Users who reset their password between a Lunchbox Site and a non-Lunchbox Site must first log in to the site where they reset their password. After logging in, they can use their new password to access both sites.
Punchh does not currently support cancelling orders on the Lunchbox Dashboard do not remove points or return rewards from the customer account on the Punchh dashboard. These need to be manipulated manually.
Punchh does not currently have a straightforward way to isolate catering activity from other loyalty activity. This has historically been a limitation, including when catering was running through Olo. Catering transactions generally flow into the same loyalty reporting as other transactions, so identifying catering performance requires looking at the underlying transaction/check-in data and comparing it against the catering provider's data.
Punchh does not currently send a rewards program description through the API. Lunchbox recommends using the content hub to link out to the existing Punchh dashboard or an FAQ to explain the program.
Onboarding Kick-off
To enable Punchh SSO and loyalty on Lunchbox ordering, we must reach out to the Punchh team.
Here's how the communication should flow:
IPM team member confirms Punchh is the target loyalty provider for the chain and identifies all live and near-term locations that need SSO enabled.
After confirmation, IPM creates the spreadsheet containing Location Name, Store ID, Web Location URL for each participating store. When ready, Lunchbox sends the CSV to Punchh for SSO URL mapping and requests client ID and secret key for the chain
Punchh then returns chain credentials: client ID and secret key
CX team member then need to submit an ENG change request to add the Punchh chain credentials to Lunchbox config. No per-location config in Lunchbox is required for SSO routing once Punchh has mapped the provided URLs on their side.
Sample Ticket:
OTS Team Member needs to Add Punchh as the Loyalty Provider to all participating locations including Store 0 - Master Restaurant
Once configuration and the ticket are complete proceed with QA user creation, login, ordering, and loyalty earn/redeem validations
Data Exchange & Configuration
Data Lunchbox IPM sends to Punchh
Location Name
Store ID
Return URL (This is the map view URL with no locations selected)
Example: https://order.sarahssweets.com
Frontend Web Location URL
NOTE: When sending the URLs to Punchh. Someone on the Punchh side needs to make an adjustment to allow the URLs to be saved.
IPM will Email the Partech Reps for the restaurant and CC the restaurant for approval.
Email Template----
Title: Configure Punchh SSO credentials for [Chain Name]
Request:
Add chain-level client ID and secret key to Lunchbox config for [Chain Name]
Client ID [value received from Punchh]
Secret Key (Key ID) [value received from Punchh]
Please find the following URLs for your configuration.
Return URL: Example: order.sarahssweets.com
Frontend Web Location URLs for SSO
Example: order.sarahssweets.com/5/avalon
Thank you in advance for your assistance.
Sincerely,
YOUR NAME
Acceptance Criteria:
Given the credentials are configured, when a user signs in via Lunchbox, a valid signed request is made to Punchh and the user session persists.
Earn and redeem events post to Punchh on “Complete” orders.
Data Punchh sends to Lunchbox
Chain-level client ID and secret key for request signing
Lunchbox configuration
Configure the chain-level client ID and secret key in Lunchbox (ENG change request)
Once the ticket is completed, we can move on to the testing phase.
The Workflow
When a user logs in, Punchh returns a single token that Lunchbox uses to manage all ongoing loyalty-related interactions. This token:
Authenticates the user across both systems
Enables real-time checks with Punchh to:
Verify user credentials
Sync wallet data (check for available points and rewards)
Check item-level reward eligibility during menu browsing or cart updates
Lunchbox uses this token continuously throughout the session to avoid requiring the guest to sign in again. For example, when the guest adds an item to their cart, Lunchbox contacts Punchh to check if that item is eligible for a reward. If it is, the applicable offer will appear in the promo section during checkout.
The below workflow diagram is a description of the Punchh API resources that can be referenced from their documentation.
Prepare Customer Order - Order information: Items, Quantities, Totals.
Fetch Account Balance - Obtain the guest's loyalty account balance (Accumulated rewards and points).
Finalize order - Calculate the subtotal of the order.
Verify Redemption - Check if a guest is eligible to redeem a reward based on the rules put in place by the merchant.
Apply Reward/Discount - If a guest is eligible, Lunchbox will apply the appropriate discount to the check.
Accept Payment - Processes and collects the funds from the guest.
Commit Redemption - Deduct the redeemed points/rewards from the guest’s balance, and provide the guest with confirmation.
User Flow Summary
User signs up or logs in → Punchh returns token via SSO
Token triggers menu and loyalty wallet sync
User browses menu → Lunchbox checks Punchh for reward-eligible items
User adds items to cart → Reward suggestions are shown if available
If applicable, user redeems a reward or claim a perk on the cart page
User places an order
Order status is "Complete"
Loyalty data is sent to Punchh
After the transaction, the loyalty account is updated:
If a reward or perk was used, it's removed from the user's Punchh account
If not, the user earns points, which are then added to their loyalty balance
Deep Linking Scope (Web Only)
SSO redirect mapping relies on web location URLs that Punchh configures on their side.
Native apps do not use these web deep links for SSO routing. App-level deep linking for promotions/locations may exist, but it is separate and should be validated per app build.
Testing Notes
Guest experience is standard Lunchbox ordering; the loyalty backend is invisible
Additional testing on brands like Taco Cabana is encouraged to validate full end-to-end visibility and redemption logic from a user perspective
FAQ
Q: Do apps use the same deep links as web for SSO routing?
A: No. SSO redirect mapping uses web location URLs that Punchh configures. Apps do not use these web deep links. Validate any separate in-app deep linking as needed.
Q: Are Punchh credentials per location or per chain?
A: Per chain. Punchh provides a chain-level client ID and secret key that Lunchbox configures once. Location URLs are still required for Punchh’s SSO mapping.