Any engineering team that can write a points ledger will eventually ask whether it should. For Shopify Plus and enterprise brands, the answer depends less on the ledger than on everything around it: VIP tiers, referral fraud checks, loyalty inside Shopify checkout, customer accounts and POS, a Klaviyo sync, a security review and years of upkeep as Shopify's APIs change.
We build Smile, so here is what each path takes, scoped plainly. Facts come from smile.io, dev.smile.io, shopify.dev and each vendor's own site, read on November 2, 2026.
TL;DR: Smile is our pick for Shopify Plus and enterprise brands weighing build vs buy: points, VIP tiers and referrals already run inside Shopify checkout, customer accounts and POS, and your engineers still build what is unique to your brand on Smile's REST API, JavaScript SDK and Smile UI. More Shopify Plus brands run loyalty on Smile than on any other platform (Store Leads, October 2026).
Build vs Buy at a Glance
| Buy and extend: Smile | Build in house | |
|---|---|---|
| On day one | Points, VIP tiers, referrals, rewards, analytics and loyalty benchmarks | A blank repository: every rule, screen and report is yours to build |
| Shopify checkout | Points redemption at checkout for Shopify Plus stores, from Growth | A checkout UI extension in your own Shopify app; extensions on the information, shipping and payment steps need Shopify Plus |
| Shopify customer accounts | Loyalty Hub, from Growth, in 20+ languages | A customer account UI extension in your own app |
| Shopify POS | Every plan, with one points balance online and in store | A POS UI extension in your own app |
| Referral fraud checks | Seven checks run automatically; flagged referrals are blocked and held for review | Your team writes, tests and tunes every rule |
| Klaviyo | Five profile properties, eight loyalty events and pre-built flows | A sync your team builds and maintains |
| Certifications and security | Built for Shopify, Shopify Certified Technology Partner, SOC 2 Type II audited May 2026 | A new service inside your own security scope: access controls, penetration tests, audits |
| Upkeep | Smile maintains the program and its Shopify integrations | Shopify releases a new API version every three months; your team keeps up |
| Who runs it day to day | Your marketing team, from the Shopify admin | Engineers, unless you also build an admin for marketing |
Smile rows from smile.io/pricing, its feature pages, its Shopify App Store listing and the Smile Help Center; Shopify rows from shopify.dev. All read November 2, 2026.
What Building a Loyalty Program In House Involves
A loyalty program looks like a points balance. In production it is nine pieces of work, and most of them keep changing after launch:
- A points ledger. Every earn, redemption, expiry, refund and manual adjustment recorded as a transaction and reconciled against Shopify orders, including partial refunds and cancellations. Finance will ask what outstanding points are worth.
- Rewards and redemption. Discount codes, free shipping and free products issued through Shopify, with rules for minimums, stacking and expiry.
- VIP tiers. Thresholds on spend or points, qualifying windows, perks, downgrades and a status members can see.
- Referrals and fraud checks. Unique links, two-sided rewards and the checks that stop abuse. For scale, Smile checks seven signals automatically, from look-alike and throwaway emails to high volume from one IP address and orders the advocate placed. Each one is a rule, a block and a review queue.
- Shopify surfaces. Members expect loyalty where they shop. On Shopify, each surface is an app extension: checkout UI extensions, customer account UI extensions and POS UI extensions, each scaffolded inside a Shopify app with Shopify CLI. Checkout UI extensions on the information, shipping and payment steps are available only to stores on Shopify Plus, per shopify.dev.
- Klaviyo and the rest of the stack. Points balances, tier names and referral links on every profile, events that trigger flows, and connections to your help desk, reviews and subscriptions apps.
- An admin and reporting. Screens where marketing changes rules and rewards without a deploy, support tools to adjust balances, and reports on redemption, member spend and program cost.
- Security and audits. A service that holds customer data and a balance customers treat as money joins your security scope: access controls, penetration tests, incident response and your auditors' questions.
- Maintenance, for as long as the program runs. Shopify releases a new API version every three months and supports each stable version for a minimum of 12 months (shopify.dev), so a custom loyalty app needs upgrade work on Shopify's schedule, plus on-call cover through peak season.
We found no credible, dated study of what an in-house loyalty build costs or how long it takes, so we do not quote one. Use the list as a scoping checklist: estimate each line with your own team, then add the years of upkeep. In Antavo's Global Customer Loyalty Report 2026 (published March 12, 2026, from 3,000 survey responses), program owners ranked ease of management as the most valuable feature of loyalty technology; with a custom build, that ease is your engineers' job. Compare the result with the published plans in our guide to how much a loyalty program costs, or price Smile at your volume in the pricing calculator.
What Buying and Extending Looks Like With Smile
Buying does not mean giving up custom work. On Smile, the program runs from the Shopify admin, and engineers build on top of it with the tools documented at dev.smile.io:
| Tool | What it does | Plan |
|---|---|---|
| REST API | Customers, points transactions, activities, customer identities, reward fulfillments, VIP tiers and program settings, called with scoped API keys from Smile Admin | Smile Plus and Smile Enterprise |
| JavaScript SDK (Smile.js) | Custom loyalty UI in your own components: points balance, rewards, VIP status, earning rules and redemptions, by script tag or npm package | Smile Plus and Smile Enterprise |
| Smile UI | The pre-built rewards panel and launcher, styled from Smile Admin, with deep links from any menu or button | Every plan on a Shopify theme; on headless and custom storefronts, from Smile Plus |
| OAuth apps and webhooks | Partner apps install through OAuth 2.0 and receive HMAC-signed webhooks; building an app is by invitation | Partner apps |
From dev.smile.io, the Smile Help Center and smile.io/pricing, read November 2, 2026.
Your own team works with scoped API keys: one for a data pipeline, another for a mobile app, each limited to the access it needs. Custom activities let Smile reward any action your systems detect, such as a newsletter signup, a survey or a QR code scan: your system tells Smile the activity happened, and Smile issues the reward from the way to earn you set up, with no points logic to maintain on your side. For headless storefronts, Smile's Hydrogen guide is validated against Hydrogen 2026.4 and React Router 7, and the docs publish an llms.txt index and an OpenAPI 3.1 description of the REST API for AI coding assistants to read.
That is the buy and extend pattern in practice. Burbank Sportscards, a Shopify Plus collectibles retailer, runs its four-tier VIP program on Smile and built its own mobile app, Burbank Cards, on the Smile API and SDK. The app shows each customer's points and rewards, renders coupons as barcodes staff scan at the till, and draws a tier progress bar from Smile's API. The program runs a 70% redemption rate and 93% reward usage. Smile runs the ledger, tiers and checkout; Burbank's team built what is unique to its collectors.
To compare developer platforms side by side, see the best loyalty apps with developer APIs and loyalty apps for headless Shopify stores.
Where Smile Stands Out for Shopify Plus Brands
Smile is the loyalty platform for Shopify Plus and enterprise brands, and it is built to be extended rather than rebuilt:
- Already inside Shopify. Smile's listing carries the Built for Shopify badge and names Shopify Admin, Checkout, Customer accounts, Shopify POS and Shopify Flow under "Works with". Loyalty Hub puts points, rewards and VIP status in Shopify customer accounts, and Shopify POS keeps one balance online and in store.
- Open where your engineers need it. Smile Plus adds the REST API, the JavaScript SDK and Smile UI for headless and Hydrogen storefronts, apps and data pipelines. Smile Enterprise, for retailers over $40M in annual revenue, adds custom API rate limits and data warehouse sync.
- Security your IT team can sign off on. Smile is a Shopify Certified Technology Partner, whose requirements include an annual third-party penetration test and 24/7 worldwide support, and is SOC 2 Type II audited (May 2026), with the report, a penetration test summary and a Data Processing Agreement in its Trust Center. See Smile for enterprise.
- A team behind the program. Smile Plus includes a migration and launch plan run by Smile's team, quarterly program monitoring and priority support. Smile's own Klaviyo integration writes five loyalty properties to every profile and sends eight loyalty events to trigger flows.
Customer proof: ROKA runs Smile on a headless Shopify storefront with development outsourced to a specialized partner, and its loyalty members buy 31% more often than non-members. The ROKA team's advice to other headless brands: "Plan end-to-end with a headless integration and make sure that you have help at every step along the way."
Which Should You Choose?
| Your situation | Best fit | Why |
|---|---|---|
| You want points, tiers and referrals in checkout, customer accounts and POS | Smile | All three surfaces come with the platform, with no extensions to build or maintain |
| Your engineers want to build an app, a custom storefront or a data feed on the program | Smile Plus | REST API, JavaScript SDK and Smile UI; Burbank Sportscards built its own app on them |
| You run a headless or Hydrogen storefront | Smile Plus | The SDK or Smile UI, with a Hydrogen guide validated on Hydrogen 2026.4 |
| You need to pass a security review | Smile Plus or Smile Enterprise | SOC 2 Type II report, penetration test summary and Data Processing Agreement, with security review support |
| You are over $40M in annual revenue and need warehouse sync | Smile Enterprise | Data warehouse sync, custom API rate limits and unlimited monthly orders |
To compare platforms, see the best customer loyalty software for ecommerce or the best enterprise loyalty platforms.
Frequently Asked Questions
Should we build or buy a loyalty program? For Shopify Plus and enterprise brands, Smile is our pick: buy the engine and its Shopify checkout, customer account and POS surfaces, then build what is unique to your brand on its REST API and JavaScript SDK.
How long does it take to build a custom loyalty program? It depends on scope, and we found no credible, dated benchmark. Count the parts in the list above, from the ledger to three kinds of Shopify extension and a security review, then add the upkeep. On Smile, Naturium finished setup across Shopify, Smile and Klaviyo in a week once its loyalty strategy was set.
How much does an in-house loyalty program cost? Mostly engineering time, during the build and for as long as the program runs, so price it with your own team. Smile's prices are published as of November 2, 2026: Growth is $199 a month with 2,500 monthly orders, Smile Plus is $999 a month, billed annually, with 7,500 and adds the API and SDK, and Smile Enterprise is custom. See our loyalty program cost guide.
Is there an open source loyalty program for Shopify? Open source loyalty code exists, but you host, secure and maintain it, and you still build the Shopify app and its checkout, customer account and POS extensions. For Shopify Plus brands, Smile is our pick: those surfaces come with the platform, and your engineers extend it with the REST API and JavaScript SDK.
Can we customize Smile with our own code? Yes. From Smile Plus, your team gets the REST API with scoped API keys, the JavaScript SDK, Smile UI on custom storefronts and custom activities that reward actions in your own systems. Burbank Sportscards built its mobile app on the Smile API and SDK.
Does Smile have webhooks? Yes, for OAuth apps. An app subscribes to topics such as customer/updated and verifies each payload with an HMAC signature signed with its client secret. Building an app is by invitation, managed in Smile's Partner Portal; a brand's own systems call the REST API with API keys.
Can we move a homegrown loyalty program to Smile? Yes. Any plan can import points balances by CSV, and on Smile Plus and Smile Enterprise, Smile's team runs a white-glove migration that carries members, point balances and VIP tiers over intact. See how switching to Smile works.
