members

Exchange a member for a shopper token

Step one of a two-step handoff. Returns an opaque, single-use token bound to the member and the calling company; redeem it at the redeem operation to obtain the shopper session. Accepts company API tokens only; admin user-company, partner, public and droplet tokens are all rejected. A member without a Customer in the calling company is rejected here rather than being materialized. The session credential never appears in a response body — a shopper JWT is long-lived, and bodies are routinely captured by logging and error tracking.

POST

api

v2025-06

members

{member_id}

customer-token-exchange

Exchange a member for a shopper token

curl --request POST \
  --url https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "handoff": "<string>",
  "expires_in": 123,
  "status": 200,
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "message": "<string>",
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "message": "<string>",
  "error": "<string>",
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "message": "<string>",
  "error": "<string>",
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "message": "<string>",
  "error": "<string>",
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "message": "<string>",
  "error": "<string>",
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

member_id

string

required

The member's native UUID or its legacy bigint (legacy_user_company_id).

Response

An opaque single-use handoff token.

An opaque, single-use handoff token. It is not a credential on its own: it must be redeemed at the redeem operation, which returns the shopper session in a response header. No JWT appears in this body.

handoff

string

required

Opaque single-use token. Redeem it once, promptly; it is consumed on redemption.

expires_in

integer

required

Seconds until the handoff token expires.

status

enum<integer>

required

Available options:

200

meta

object

required

Show child attributes

Exchange a member for a shopper token

curl --request POST \
  --url https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.fluid.app/api/v2025-06/members/{member_id}/customer-token-exchange")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "handoff": "<string>",
  "expires_in": 123,
  "status": 200,
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "message": "<string>",
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "message": "<string>",
  "error": "<string>",
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "message": "<string>",
  "error": "<string>",
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "message": "<string>",
  "error": "<string>",
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "message": "<string>",
  "error": "<string>",
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

Overview

Task guides

Portal & Widgets

Endpoints

Auth endpoints

Checkout endpoints

Public SDK endpoints

Member endpoints

Payment gateway endpoints

Cart payment endpoints

Commerce endpoints

Webhooks endpoints

Company admin endpoints (v0)

Analytics

Exchange a member for a shopper token

Authorizations

Path Parameters

Response