Issue a checkout URL that carries the shopper's login
Issues the checkout URL for a shopper already logged in with a cart JWT
(customer, member or rep session). The URL carries a single-use,
short-lived handoff token, never the JWT. Checkout exchanges it through
POST /api/carts/{cart_token}/redeem_handoff for the same member’s
session.
Only the member on the cart (the one the magic-link login assigned) may
hand it off. Any other login is refused with 403, and a rep token only
counts in the company it was issued for.
The handoff is bound to the session that asked for it. Redemption mints the same kind of session (a shopper session never becomes a rep one), refuses a member locked or signed out everywhere since, and the minted session expires no later than the one presented.
The plain checkout URL is returned with 200 instead, and the shopper
logs in at checkout, when the handoff can’t be used:
- an operator is acting as the member
- the token is not a legacy session token with an issue and expiry time
- the cart’s company signs in through the identity service
- the token store is unavailable
curl --request POST \
--url https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"checkout_url": "https://checkout.dundermifflin.example/checkouts/c4Rt7oKen9xQ?handoff=Zk3v9QWm2pLr8TnY5bXc1HdF6sJgA0eU",
"meta": {
"request_id": "3f6c2a1e-8b7d-4e2a-9c51-0d4b7e9a2f13",
"timestamp": "2026-10-28T14:30:00Z"
}
}{
"message": "Invalid credentials"
}{
"error_message": "This cart belongs to another member",
"errors": {
"cart": [
"belongs to another member"
]
},
"meta": {
"request_id": "3f6c2a1e-8b7d-4e2a-9c51-0d4b7e9a2f13",
"timestamp": "2026-10-28T14:30:00Z"
}
}{
"error_message": "<string>",
"errors": "<string>",
"meta": {
"request_id": "<string>",
"timestamp": "2023-11-07T05:31:56Z",
"code": "<string>",
"blocked_date": "2026-11-30",
"blocked_day": 30,
"allowed_date": "2026-11-28",
"payment_uuid": "<string>",
"error_details": [
{
"code": "<string>",
"field": "<string>",
"payment": "not_attempted",
"message": "<string>"
}
],
"coded_recovery": true
}
}Authorizations
Bearer token authentication
Path Parameters
Cart token
curl --request POST \
--url https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fluid.app/api/checkout/v2026-04/carts/{cart_token}/handoff")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"checkout_url": "https://checkout.dundermifflin.example/checkouts/c4Rt7oKen9xQ?handoff=Zk3v9QWm2pLr8TnY5bXc1HdF6sJgA0eU",
"meta": {
"request_id": "3f6c2a1e-8b7d-4e2a-9c51-0d4b7e9a2f13",
"timestamp": "2026-10-28T14:30:00Z"
}
}{
"message": "Invalid credentials"
}{
"error_message": "This cart belongs to another member",
"errors": {
"cart": [
"belongs to another member"
]
},
"meta": {
"request_id": "3f6c2a1e-8b7d-4e2a-9c51-0d4b7e9a2f13",
"timestamp": "2026-10-28T14:30:00Z"
}
}{
"error_message": "<string>",
"errors": "<string>",
"meta": {
"request_id": "<string>",
"timestamp": "2023-11-07T05:31:56Z",
"code": "<string>",
"blocked_date": "2026-11-30",
"blocked_day": 30,
"allowed_date": "2026-11-28",
"payment_uuid": "<string>",
"error_details": [
{
"code": "<string>",
"field": "<string>",
"payment": "not_attempted",
"message": "<string>"
}
],
"coded_recovery": true
}
}