> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fluid.app/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> For new direct REST integrations, use the v2026-04 surfaces. The @fluid-app FairShare SDK continues to use its own published public-v2025-06 contract.
> Authenticate with the header Authorization: Bearer <token>; public storefront read endpoints require no auth.
> Lists use cursor pagination via the page[cursor] and page[limit] query params; follow meta.pagination.next_cursor until it is null.
> Never use /api/company/v1 or /api/v1 paths, page/per_page params, or offset pagination — they are legacy.
> The OpenAPI specs under api-reference/ are the authoritative contracts; prefer them over prose when in doubt. api-reference/storefront-v2026-04.yaml covers the v2026-04 storefront surface (/api/v202604/... paths); api-reference/auth-v0.yaml covers the unversioned auth surface (/api/... paths — authentication, MFA, social auth, and token exchange); api-reference/checkout-v2026-04.yaml covers the v2026-04 checkout surface (/api/checkout/v2026-04/... paths — carts, cart auth, discounts, items, subscriptions, orders, enrollments, and store config); api-reference/public-v2025-06.yaml covers the Public SDK surface used by the @fluid-app FairShare SDK, including its parallel cart lifecycle, browser integrations, versioned payment callbacks, unversioned public utilities, and the cart price-override operation; api-reference/payment-v2026-04.yaml covers the v2026-04 payment gateway admin surface (/api/payment/v2026-04/... paths, bearer-authenticated — gateway CRUD, gateway purchase/authorize/$0-verify, transaction list/show and capture/void/credit, and merchant payment configuration); api-reference/payments-v2026-04.yaml covers the v2026-04 cart payment surface (/api/payments/v2026-04/carts/{cart_token}/... paths, authenticated by the cart token in the path with no bearer — payment-method selection, VGS card tokenization, 3D Secure verification, and PayPal/Braintree/Klarna/Apple Pay flows); api-reference/commerce-v2026-04.yaml covers the v2026-04 commerce order-editing surface (/api/v202604/orders/{order_id}/edits paths, bearer-authenticated — post-checkout order edits that atomically insert items and add adjustments/discounts, with an optional dry-run preview); api-reference/webhooks-v0.yaml covers the unversioned webhooks surface (/api/... paths — webhook registration, delivery payloads, callback registrations, company events, and webhook/callback schemas).
> Successful responses wrap the resource payload alongside a top-level integer status and a meta object.

# Fluid API Authentication — Token Types and Scopes

> Learn how to authenticate Fluid API requests using company, partner, and public tokens, how to pass a bearer token, and the storefront company scopes.

Company endpoints on the Fluid API are authenticated with a bearer token. Fluid provides three token types for integrators — company, partner, and public — each designed for a different trust level and integration pattern. Public storefront read endpoints require no token at all; everything below applies to the token-authenticated company surface.

## Passing your token

Include your token in the `Authorization` header, prefixed with `Bearer `:

```bash theme={null}
curl https://api.fluid.app/api/v202604/company/products \
  -H "Authorization: Bearer <your_token>" \
  -H "Content-Type: application/json"
```

A request with a missing, invalid, expired, or revoked token receives a `401 Unauthorized`. The `401` body is a bare `{ "message": "..." }` object rather than the wrapped error envelope used by `404` and `422` responses — see [Errors](/api/overview#errors) for the full envelope contract.

## Token types

Each token type has a different scope of access and a different lifecycle.

### Company token

A company token grants full administrative access to your Fluid account, equivalent to a logged-in admin. Use company tokens for server-side integrations, internal tooling, and automation scripts where you fully control the runtime environment.

Create a company token from your Fluid dashboard under **Settings → Developer**. This is the primary way to obtain a company token.

<Warning>
  Never use a company token in client-side JavaScript or commit it to a public repository. Anyone who obtains a company token has full access to your account.
</Warning>

### Partner token

A partner token provides company-level access for third-party integrations. Partner tokens support an optional expiration and can be tied to a role, making them safer to distribute than a raw company token. They suit agency-built integrations, certified app partners, and automated workflows that need elevated access without sharing your primary company token.

### Public token

A public token is designed for client-side use and is scoped to a limited set of read and asset permissions, so it can be embedded in browser code or mobile apps. Because a public token is exposed to end users, keep its access as narrow as your integration allows.

<Note>
  Programmatic management of partner and public tokens — creating, rotating, and revoking them — is handled in the Fluid dashboard under **Settings → Developer**. A published API reference for token management is forthcoming.
</Note>

## Storefront company permissions

The v2026-04 storefront company endpoints (`/api/v202604/company/...`) accept a company-admin bearer token carrying `storefront.view` for reads and `storefront.update` for writes.

## Best practices

* **Store tokens in environment variables.** Never hard-code tokens in source files. Use `.env` files locally and a secrets manager (such as AWS Secrets Manager or Vault) in production.
* **Use the least-privileged token type.** Prefer public tokens for client-side code, partner tokens for third-party integrations, and reserve company tokens for fully trusted server-side environments.
* **Prefer expiring tokens.** Even for long-running integrations, favor tokens that expire and are refreshed over indefinite ones.
* **Rotate and audit.** Periodically regenerate tokens, and review and revoke unused tokens under **Settings → Developer**.