Cross-Program Invocations (CPI)

Signing with PDA Seeds (CpiContext::new_with_signer)

Because the mint authority is the LoyaltyProgram PDA, the program signs the SPL token instruction without a private key:

let seeds: &[&[u8]] = &[
    b"loyalty",
    merchant_key.as_ref(),
    &[loyalty_program.bump],
];
let signer_seeds = &[seeds];

token::mint_to(
    CpiContext::new_with_signer(
        ctx.accounts.token_program.to_account_info(),
        MintTo {
            mint: ctx.accounts.points_mint.to_account_info(),
            to: ctx.accounts.customer_token_account.to_account_info(),
            authority: ctx.accounts.loyalty_program.to_account_info(),
        },
        signer_seeds,
    ),
    points,
)?;