# Let Cardholders Redeem Points From Your Issuer Rewards Website
source: https://developer.mastercard.com/digital-redemptions/documentation/tutorials-and-guides/issuer-rewards-website-sso/index.md

This guide shows a bank or card issuer, and the merchant partners it works
with, how to let cardholders redeem reward points for purchases that start on
the issuer's rewards website. The cardholder signs in to the rewards portal,
chooses a merchant, is handed over through single sign-on (SSO), and pays with
points on the merchant site.

## Who this guide is for {#who-this-guide-is-for}

* Banks and card issuers that run a rewards program and want cardholders to spend points with online merchants rather than only through a catalogue.
* Merchants that accept traffic from an issuer's rewards portal and need to price items in points and complete the redemption.

For the merchant-hosted flow, where the cardholder starts at the merchant
checkout and enters a card number, see
[Integrate Pay with Points Into Your Ecommerce Checkout](https://developer.mastercard.com/digital-redemptions/documentation/tutorials-and-guides/integrate-pay-with-points-checkout/index.md).

## What you will build {#what-you-will-build}

1. A hand-off from the issuer rewards website to the merchant through SSO that identifies the cardholder.
2. A merchant experience that shows the points balance and prices items in points and currency.
3. A checkout that pays some or all of the order with points.
4. An automatic refund of points when the cardholder cancels.

## Prerequisites {#prerequisites}

* A Mastercard Developers project with the Digital Redemptions API added. Follow [Create a Sandbox Project](https://developer.mastercard.com/digital-redemptions/documentation/tutorials-and-guides/sandbox-access-tutorial/index.md).
* A client that signs requests with OAuth 1.0a. See [API Basics](https://developer.mastercard.com/digital-redemptions/documentation/api-basics/index.md).
* An SSO agreement between the issuer and the merchant. The SSO token format and the cardholder identifier it carries (RANAC or BCN) are agreed with your Mastercard account team during onboarding.

## Endpoint sequence {#endpoint-sequence}

| Step |               Where                |                          Endpoint                           |                                          Purpose                                           |
|------|------------------------------------|-------------------------------------------------------------|--------------------------------------------------------------------------------------------|
| 1    | Issuer rewards website             | (SSO hand-off)                                              | Cardholder signs in, picks a merchant, and is redirected with a token that identifies them |
| 2    | Merchant site                      | `GET /redeemers/{user_id}` or `POST /redeemers/search`      | Retrieve the points balance and cost per point for the identified cardholder               |
| 3    | Merchant site                      | (no call)                                                   | Show the balance and price items in points and currency                                    |
| 4    | Merchant checkout                  | `POST /redemptions`                                         | Redeem the points and receive a `redemptionId`                                             |
| 5    | Merchant checkout (physical goods) | `GET /redemptions/addresses`, `POST /redemptions/addresses` | Reuse or capture the shipping address for the redemption                                   |
| 6    | Cancellation                       | `POST /redemptions/{id}/credits`                            | Refund all or part of the points to the cardholder                                         |

### 1. Hand the cardholder to the merchant through SSO {#1-hand-the-cardholder-to-the-merchant-through-sso}

The cardholder signs in to the issuer's rewards website and selects a
participating merchant. The issuer redirects to the merchant with an SSO
token that carries the cardholder identifier. Because the cardholder is
already authenticated by the issuer, the merchant does not ask for a card
number.

### 2. Retrieve the points balance {#2-retrieve-the-points-balance}

* If the SSO token carries the RANAC, call `GET /redeemers/{user_id}`. No payload encryption is needed.
* If it carries a BCN or BAN, call `POST /redeemers/search` with an encrypted body to translate it to a RANAC and retrieve the balance in one step.

Pass a `redemptionItemId` to receive the cost per point so you can show
currency values.

See [Get Redeemer Profile](https://developer.mastercard.com/digital-redemptions/documentation/use-cases/redeemers-profile/get-redeemer-profile/index.md)
and [Search Redeemer Profile](https://developer.mastercard.com/digital-redemptions/documentation/use-cases/redeemers-profile/search-redeemer-profile/index.md).

### 3. Show the balance and price items in points {#3-show-the-balance-and-price-items-in-points}

Display the points balance as soon as the cardholder lands on the merchant
site, and show prices in both points and currency so the cardholder can judge
the value of their rewards. Design guidance and Figma journeys are in
[Redeem Points From the Issuer Rewards Website (SSO)](https://developer.mastercard.com/digital-redemptions/documentation/experience-design-guide/design/redemption-issuer-rwd-website-sso/index.md)
and [Moments That Matter](https://developer.mastercard.com/digital-redemptions/documentation/experience-design-guide/moments-that-matter/index.md).

### 4. Redeem the points {#4-redeem-the-points}

At checkout, offer pay with points or points plus card. Call
`POST /redemptions` with the RANAC, the `redemptionType`, and either
`pointsRedeemed` with a `redemptionMatrixItemId` or `cashEquivalent` with a
`redemptionItemId`. Store the returned `redemptionId` against the booking or
order.

See [Create Redemptions](https://developer.mastercard.com/digital-redemptions/documentation/use-cases/redemptions/post-redemptions/index.md).

### 5. Capture a shipping address (physical goods only) {#5-capture-a-shipping-address-physical-goods-only}

Call `GET /redemptions/addresses` to offer the addresses the cardholder used
recently, or `POST /redemptions/addresses` to record a new one.

See [Get Shipping Addresses](https://developer.mastercard.com/digital-redemptions/documentation/use-cases/redemptions/get-shipping-addresses/index.md)
and [Create Shipping Addresses](https://developer.mastercard.com/digital-redemptions/documentation/use-cases/redemptions/post-shipping-addresses/index.md).

### 6. Refund points on cancellation {#6-refund-points-on-cancellation}

When the cardholder cancels through the merchant site (for example from a
"My trips" page), call `POST /redemptions/{id}/credits` with the
`redemptionId`. Use `partialCreditPoints` for a partial refund. The points
return to the cardholder's account immediately.

See [Reverse Redemption](https://developer.mastercard.com/digital-redemptions/documentation/use-cases/redemptions/reverse-redemption/index.md)
and the [Refund Points When a Booking Is Cancelled](https://developer.mastercard.com/digital-redemptions/documentation/experience-design-guide/design/booking-cancellation-refund/index.md)
journey.

## Test in Sandbox {#test-in-sandbox}

Use the test data described in
[Create a Sandbox Project](https://developer.mastercard.com/digital-redemptions/documentation/tutorials-and-guides/sandbox-access-tutorial/index.md)
and the Java walkthrough in
[Integration and Testing](https://developer.mastercard.com/digital-redemptions/documentation/tutorials-and-guides/api-testing-tutorial/index.md)
to exercise the sequence above end to end.

## Next Steps {#next-steps}

* Request production credentials: [Production Access](https://developer.mastercard.com/digital-redemptions/documentation/tutorials-and-guides/production-access-tutorial/index.md).
* Review all endpoints in the [API Reference](https://developer.mastercard.com/digital-redemptions/documentation/api-reference/index.md).