> ## Documentation Index > Fetch the complete documentation index at: https://docs.fluid.app/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > For new direct REST integrations, use the v2026-04 surfaces. The @fluid-app FairShare SDK continues to use its own published public-v2025-06 contract. > Authenticate with the header Authorization: Bearer ; public storefront read endpoints require no auth. > Lists use cursor pagination via the page[cursor] and page[limit] query params; follow meta.pagination.next_cursor until it is null. > Never use /api/company/v1 or /api/v1 paths, page/per_page params, or offset pagination — they are legacy. > The OpenAPI specs under api-reference/ are the authoritative contracts; prefer them over prose when in doubt. api-reference/storefront-v2026-04.yaml covers the v2026-04 storefront surface (/api/v202604/... paths); api-reference/auth-v0.yaml covers the unversioned auth surface (/api/... paths — authentication, MFA, social auth, and token exchange); api-reference/checkout-v2026-04.yaml covers the v2026-04 checkout surface (/api/checkout/v2026-04/... paths — carts, cart auth, discounts, items, subscriptions, orders, enrollments, and store config); api-reference/public-v2025-06.yaml covers the Public SDK surface used by the @fluid-app FairShare SDK, including its parallel cart lifecycle, browser integrations, versioned payment callbacks, unversioned public utilities, and the cart price-override operation; api-reference/payment-v2026-04.yaml covers the v2026-04 payment gateway admin surface (/api/payment/v2026-04/... paths, bearer-authenticated — gateway CRUD, gateway purchase/authorize/$0-verify, transaction list/show and capture/void/credit, and merchant payment configuration); api-reference/payments-v2026-04.yaml covers the v2026-04 cart payment surface (/api/payments/v2026-04/carts/{cart_token}/... paths, authenticated by the cart token in the path with no bearer — payment-method selection, VGS card tokenization, 3D Secure verification, and PayPal/Braintree/Klarna/Apple Pay flows); api-reference/commerce-v2026-04.yaml covers the v2026-04 commerce order-editing surface (/api/v202604/orders/{order_id}/edits paths, bearer-authenticated — post-checkout order edits that atomically insert items and add adjustments/discounts, with an optional dry-run preview); api-reference/webhooks-v0.yaml covers the unversioned webhooks surface (/api/... paths — webhook registration, delivery payloads, callback registrations, company events, and webhook/callback schemas). > Successful responses wrap the resource payload alongside a top-level integer status and a meta object. # Tokenize payment credentials > Vaults payment credentials via VGS. Requires a valid customer JWT. ## OpenAPI ````yaml /api-reference/checkout-v2026-04.yaml post /api/checkout/v2026-04/customers/me/payment_methods/tokenize openapi: 3.1.0 info: title: Fluid Checkout API description: >- **Fluid Checkout API — for building a checkout directly against REST.** Use this surface if you are integrating server-to-server or building your own checkout UI. It covers the full order lifecycle (cart → address → shipping → discount → complete → order) plus the logged-in customer's account: saved addresses, saved payment methods, order history, loyalty points, and subscription management (pause, resume, skip, cancel, retry). **The cart token in the URL scopes cart access** — creating a cart, adding items, applying a discount, and completing a cart need no bearer token. Among the cart operations, a Bearer token is required only for `carts/{cart_token}/sync`, `carts/{cart_token}/volume_rep`, and `carts/{cart_token}/discount/manual`. Off the cart, a token is required for everything under `customers/me` and `subscriptions`, and for the store and directory lookups (`store/config`, `store/languages`, `reps`, `users`) and `subscription_bundles`. `store/countries` accepts a token but does not require one — it returns the same list either way. **If you are using the `@fluid-app` FairShare SDK in a theme or storefront, you are not calling this surface** — the SDK calls the Fluid Public SDK API (`public-v2025-06`). Do not mix the two against one cart: they share the same cart records and services, but their request shapes differ. See [Choosing a cart surface](https://docs.fluid.app/api/choosing-a-cart-surface) for the operation map and boundary. version: v2026-04 contact: email: support@fluid.app license: name: Proprietary identifier: LicenseRef-Proprietary servers: - url: https://api.fluid.app security: [] tags: - name: carts description: >- Create, read, and mutate checkout carts (email, address, country, language, shipping, recalculation, completion). - name: cart-auth description: >- Cart-scoped customer authentication — magic-link challenge, verification, identity, and logout. - name: cart-discount description: >- Apply, list, and remove cart discount codes, including admin manual discounts. - name: cart-items description: Add, update, and remove line items on a cart. - name: cart-points description: Apply and remove loyalty points on a cart. - name: customers description: The authenticated customer's profile and company memberships. - name: customer-addresses description: The authenticated customer's saved shipping/billing addresses. - name: customer-orders description: The authenticated customer's order history. - name: customer-payment-methods description: The authenticated customer's saved payment methods and tokenization. - name: customer-points description: The authenticated customer's loyalty point balances. - name: directory description: Company rep and user directory lookups. - name: enrollments description: >- Public enrollment forms — retrieve a form and submit, update, or upload field answers. - name: orders description: Public order lookup by token. - name: products description: Public product queries for the storefront checkout. - name: store description: >- Store-level checkout configuration — countries, languages, address fields, agreements, drop zones, and Apple Pay domain verification. - name: subscriptions description: >- Manage subscriptions — pause, resume, skip, cancel, reactivate, retry, and failed-cycle waivers. - name: subscription-bundles description: List and create subscription bundles. paths: /api/checkout/v2026-04/customers/me/payment_methods/tokenize: post: tags: - customer-payment-methods summary: Tokenize payment credentials description: Vaults payment credentials via VGS. Requires a valid customer JWT. operationId: checkout_v2026_04_tokenize_customer_payment_method requestBody: content: application/json: schema: type: object additionalProperties: false properties: jwt: type: string description: >- Customer JWT. VGSVaultAction validates required(:jwt), but the controller injects it from the Authorization bearer header (fluid_pay_params); a jwt sent in the body is redundant. No other fields are read. responses: '200': description: Success content: application/json: schema: $ref: >- #/components/schemas/CheckoutCustomerPaymentMethodTokenizeResponse '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/UnauthorizedResponse' security: - bearer_auth: [] components: schemas: CheckoutCustomerPaymentMethodTokenizeResponse: type: object properties: meta: $ref: '#/components/schemas/Meta' vault: type: object properties: environment: type: string mode: type: string requires_3ds: type: boolean route_id: type: string vault_id: type: string required: - environment - mode - requires_3ds - route_id - vault_id additionalProperties: false required: - meta - vault additionalProperties: false UnauthorizedResponse: type: object properties: message: type: string required: - message Meta: type: object properties: request_id: type: - string - 'null' timestamp: type: string format: date-time securitySchemes: bearer_auth: type: http scheme: bearer description: Bearer token authentication ````