Skip to main content
Company endpoints on the Fluid API are authenticated with a bearer token. Fluid provides three token types for integrators — company, partner, and public — each designed for a different trust level and integration pattern. Public storefront read endpoints require no token at all; everything below applies to the token-authenticated company surface.

​
Passing your token

Include your token in the Authorization header, prefixed with Bearer :
A request with a missing, invalid, expired, or revoked token receives a 401 Unauthorized. The 401 body is a bare { "message": "..." } object rather than the wrapped error envelope used by 404 and 422 responses — see Errors for the full envelope contract.

​
Token types

Each token type has a different scope of access and a different lifecycle.

​
Company token

A company token grants full administrative access to your Fluid account, equivalent to a logged-in admin. Use company tokens for server-side integrations, internal tooling, and automation scripts where you fully control the runtime environment. Create a company token from your Fluid dashboard under Settings → Developer. This is the primary way to obtain a company token.
Never use a company token in client-side JavaScript or commit it to a public repository. Anyone who obtains a company token has full access to your account.

​
Partner token

A partner token provides company-level access for third-party integrations. Partner tokens support an optional expiration and can be tied to a role, making them safer to distribute than a raw company token. They suit agency-built integrations, certified app partners, and automated workflows that need elevated access without sharing your primary company token.

​
Public token

A public token is designed for client-side use and is scoped to a limited set of read and asset permissions, so it can be embedded in browser code or mobile apps. Because a public token is exposed to end users, keep its access as narrow as your integration allows.
Programmatic management of partner and public tokens — creating, rotating, and revoking them — is handled in the Fluid dashboard under Settings → Developer. A published API reference for token management is forthcoming.

​
Storefront company permissions

The v2026-04 storefront company endpoints (/api/v202604/company/...) accept a company-admin bearer token carrying storefront.view for reads and storefront.update for writes.

​
Best practices

  • Store tokens in environment variables. Never hard-code tokens in source files. Use .env files locally and a secrets manager (such as AWS Secrets Manager or Vault) in production.
  • Use the least-privileged token type. Prefer public tokens for client-side code, partner tokens for third-party integrations, and reserve company tokens for fully trusted server-side environments.
  • Prefer expiring tokens. Even for long-running integrations, favor tokens that expire and are refreshed over indefinite ones.
  • Rotate and audit. Periodically regenerate tokens, and review and revoke unused tokens under Settings → Developer.