payments

Provision VGS vault credentials

Resolves the CreditCard payment account for the cart, pins the routing decision on the cart, and returns the VGS Collect vault credentials used to tokenize card data client-side. No request body. This begins the card payment flow: after tokenizing the card (and completing 3D Secure via verify when the returned requires_3ds is true) the server produces a Fluid payment reference that the Cart checkout complete_cart step (POST /api/checkout/v2026-04/carts/{cart_token}/complete, Checkout endpoints reference) consumes as its payment_uuid query parameter. Cart-token authenticated. Returns 404 when the cart or payment account is not found and 410 when the cart has already been processed or holds an authorized enrollment.

POST

api

payments

v2026-04

carts

{cart_token}

tokenize

Provision VGS vault credentials

curl --request POST \
  --url https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/tokenize

const options = {method: 'POST'};

fetch('https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/tokenize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/tokenize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/tokenize"

	req, _ := http.NewRequest("POST", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/tokenize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

{
  "vault": {
    "vault_id": "tntabc123",
    "environment": "sandbox",
    "route_id": "rt_9x8y7z",
    "mode": "vault",
    "requires_3ds": false
  },
  "requires_3ds": false,
  "payment_account_id": 4021,
  "meta": {
    "request_id": "018f2c1a-8b3a-7e6d-9f10-2a3b4c5d6e7f",
    "timestamp": "2026-04-01T12:00:00Z"
  }
}

{
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z",
    "shop_url": "<string>",
    "cart": {}
  }
}

Headers

X-Checkout-Journey-Id

string

Optional non-authorizing checkout journey UUID. Use with X-Checkout-Attempt-Id. Capture is disabled by default; malformed or incomplete pairs are ignored without changing checkout behavior. Cart scope comes from the authenticated cart token, never these headers.

X-Checkout-Attempt-Id

string

Optional customer-submission UUID paired with X-Checkout-Journey-Id. Retain it for transport retries and originating continuations; use a new UUID for a new customer submission. It does not replace payment or order idempotency keys. Invalid pairs are ignored rather than rejecting payment.

Path Parameters

cart_token

string

required

Opaque cart token returned by the create-cart response. It scopes the request to a single cart and is the credential for these endpoints — cart-token authentication carried in the path, with no bearer token or API key.

Response

Vault credentials

Success body for VGS vault provisioning.

vault

object

required

VGS Collect vault credentials used to tokenize card data client-side.

Show child attributes

requires_3ds

boolean

required

true when 3D Secure is required for this card; mirrors vault.requires_3ds. When true, call verify before authorizing.

payment_account_id

integer

required

Id of the CreditCard payment account resolved and pinned to the cart for this tokenization. Routing normally stays fixed to this account for the rest of the flow, but a stale pin is invalidated and re-resolved when the account set that produced it changes (for example after a gateway configuration change), so a later call can return a different account.

meta

object

required

Standard response metadata included on every response.

Show child attributes

Provision VGS vault credentials

curl --request POST \
  --url https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/tokenize

const options = {method: 'POST'};

fetch('https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/tokenize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/tokenize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/tokenize"

	req, _ := http.NewRequest("POST", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/tokenize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

{
  "vault": {
    "vault_id": "tntabc123",
    "environment": "sandbox",
    "route_id": "rt_9x8y7z",
    "mode": "vault",
    "requires_3ds": false
  },
  "requires_3ds": false,
  "payment_account_id": 4021,
  "meta": {
    "request_id": "018f2c1a-8b3a-7e6d-9f10-2a3b4c5d6e7f",
    "timestamp": "2026-04-01T12:00:00Z"
  }
}

{
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z"
  }
}

{
  "error_message": "<string>",
  "errors": "<string>",
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z",
    "shop_url": "<string>",
    "cart": {}
  }
}

Overview

Task guides

Portal & Widgets

Endpoints

Auth endpoints

Checkout endpoints

Public SDK endpoints

Member endpoints

Payment gateway endpoints

Cart payment endpoints

Commerce endpoints

Webhooks endpoints

Company admin endpoints (v0)

Analytics

Provision VGS vault credentials

Headers

Path Parameters

Response