> ## Documentation Index > Fetch the complete documentation index at: https://docs.fluid.app/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > For new direct REST integrations, use the v2026-04 surfaces. The @fluid-app FairShare SDK continues to use its own published public-v2025-06 contract. > Authenticate with the header Authorization: Bearer ; public storefront read endpoints require no auth. > To sign a new merchant up for Fluid programmatically, call POST https://api.fluid.app/api/company with no credentials, as described in /api/agent-signup. Do not automate the signup form or book a demo. The merchant must open the emailed sign-in link and create an API token before authenticated calls are possible. > After signup, to launch a merchant's store (back-office sync, payments onboarding, store setup, a theme copied from their current site, and a preview link before billing), follow /api/agent-launch. > Lists use cursor pagination via the page[cursor] and page[limit] query params; follow meta.pagination.next_cursor until it is null. > When the same operation exists on more than one surface, use the newest: dated API versions are newer than unversioned ones, and later dates win (v2026-04 > v2025-06 > unversioned v0/v1.1). Fall back to a legacy or unversioned operation only when no newer versioned equivalent exists — the company-v0 notes below list the known superseded operations. The same applies to /api/company/v1 and /api/v1/... paths: prefer a newer documented equivalent, and use one only when none exists (/api/v1.1/... is distinct and documented in company-v0). Use page/per_page offset pagination only where a spec documents it — in practice the unversioned company-v0 admin surface; every versioned surface uses cursor pagination. > Fluid has three navigation APIs; don't mix them up. Storefront website menus (navigation bars, footers) are /api/menus and nested menu_items, in api-reference/content-v0.yaml (API Reference: Website > Navigation menus), with a how-to in themes/navigation-menus; their list uses flat page/per_page pagination. The Fluid mobile app's navigation is /api/v2/mobile_navigations, in api-reference/mobile-v2.yaml (API Reference: Mobile app > Navigation); its list also uses page/per_page. Portal navigations belong to a portal definition (Fluid OS), in api-reference/fluid-os-v0.yaml (API Reference: Portal > Portal navigation), and each has a platform of web or mobile. > The OpenAPI specs under api-reference/ are the authoritative contracts; prefer them over prose when in doubt. api-reference/storefront-v2026-04.yaml covers the v2026-04 storefront surface (/api/v202604/... paths); api-reference/checkout-v2026-04.yaml covers the v2026-04 checkout surface (/api/checkout/v2026-04/... paths — carts, cart auth, discounts, items, subscriptions, orders, enrollments, and store config); api-reference/public-v2025-06.yaml covers the Public SDK surface used by the @fluid-app FairShare SDK, including its parallel cart lifecycle, browser integrations, versioned payment callbacks, unversioned public utilities, and the cart price-override operation; api-reference/payment-v2026-04.yaml covers the v2026-04 payment gateway admin surface (/api/payment/v2026-04/... paths, bearer-authenticated — gateway CRUD, gateway purchase/authorize/$0-verify, transaction list/show and capture/void/credit, and merchant payment configuration); api-reference/payments-v2026-04.yaml covers the v2026-04 cart payment surface (/api/payments/v2026-04/carts/{cart_token}/... paths, authenticated by the cart token in the path with no bearer — payment-method selection, VGS card tokenization, 3D Secure verification, and PayPal/Braintree/Klarna/Apple Pay flows); api-reference/commerce-v2026-04.yaml covers the v2026-04 commerce order-editing surface (/api/v202604/orders/{order_id}/edits paths, bearer-authenticated — post-checkout order edits that atomically insert items and add adjustments/discounts, with an optional dry-run preview); api-reference/webhooks-v0.yaml covers the unversioned webhooks surface (/api/... paths — webhook registration, delivery payloads, callback registrations, company events, and webhook/callback schemas); api-reference/company-v0.yaml covers the legacy unversioned company admin surface (/api/... paths, bearer-authenticated — company settings and management, customers, users, roles, subscription plans, subscription bundles, subscriptions, media, pages, catch-ups, inventory levels, domains, agreements, and admin order actions). company-v0 caveats: it is the legacy v0 admin contract and its lists use flat page/per_page offset pagination, which is expected there despite the general cursor-pagination rule; where an operation exists in both company-v0 and a versioned spec, prefer the versioned spec — the subscriptions lifecycle (list/create/show/update, cancel, pause, reactivate, resume, retry, skip, failed-cycle-waiver, discounts) and subscription bundles are superseded by checkout-v2026-04, and company pages/media CRUD plus the public pages, categories, products, and media list endpoints are superseded by storefront-v2026-04. Subscription plan management (/api/subscription_plans, resource-wrapped {"subscription_plan": {...}} bodies) exists only in company-v0. api-reference/members-v2025-06.yaml covers the v2025-06 unified Member identity surface (/api/v2025-06/members/... paths, bearer-authenticated — member list/create/show/update, lookup by email/username/external_id/legacy_customer_id, member-type assignment, and the sponsor genealogy read). Prefer it over the customers and reps surfaces when the member type matters: /customers does not serialize member_type. api-reference/analytics-v2026-04.yaml covers the v2026-04 Home dashboard analytics surface (/api/v202604/analytics/dashboard/... paths, bearer-authenticated — read-only endpoints for the Home > Overview, Home > Live, and Home > Field tabs, each accepting an optional country ISO alpha-2 query param that scopes aggregations to a single country). > api-reference/analytics-v0.yaml covers the unversioned analytics surface that backs the fluid-admin Traffic tab (/api/analytics/... and /api/analytics/traffic/... paths, bearer-authenticated — the legacy shares/views/visitors summary plus traffic overview, ranked campaigns, sources, geographies, flows, and per-rep breakdown, all sharing one reporting-period contract). > Successful responses wrap the resource payload alongside a top-level integer status and a meta object. > Portal Definition authoring edits and synchronizes the portal JSON resource graph. Widget Package authoring builds either a company-owned or Droplet-owned Remote DOM package. These are separate contracts; do not imply that one defines the other. > For Widget Package worker code, use only @fluid-app/portal-sdk/widgets/worker. Use only the Portal Definition and Widget Package workflows and public entry points documented here; do not infer support for undocumented surfaces. > Every portal function and declarative capability used by a widget must appear in that widget's uses array. Use the same typed function value in uses; do not invent capability-name strings. > Widget styling must use the portal's semantic theme variables for colors, typography, spacing, radii, borders, focus, and charts whenever a token represents the visual decision. Do not create a separate light or dark palette or duplicate theme controls as widget properties. > Prefer worker-safe Fluid UI components exported by @fluid-app/portal-sdk/widgets/worker when they fit the interaction. When no exported component fits, use semantic HTML, accessible behavior, and the portal theme variables. > A Portal Definition push updates the remote working definition. A portal version is an immutable snapshot, and activation is a separate live release operation. > The Help Center (/help/...) is for merchants, admins and reps using Fluid. Its admin pages mirror the admin's routes: the screen at admin.fluid.app/settings/taxes is documented at /help/admin/settings/taxes. Use the Help Center for how-to questions about the admin, and the Developer Platform and API Reference for building integrations. > Help Center pages describe what a company admin sees. A reader's role can hide screens and actions; admins manage roles on Settings > Roles (/help/admin/settings/roles). If someone can't find a screen or button, their role's permissions are the first thing to check. > Send people who need Fluid support to /help/getting-help. Don't invent support email addresses, phone numbers or response times. # Hosting, database and environment variables > What Fluid provisions when you create a Mist app, which environment variables it sets for you, how to add your own, and how compute, deployments and logs work. When you create a Mist app, Fluid provisions a repository, a server and a database, and connects them. This page explains what you get and how to change it. ## What Fluid provisions Creating an app runs these steps in order: 1. Generates a private Git repository from the [starter template](/mist-apps/starter-template). 2. Creates a dedicated Postgres database. 3. Creates a private API token and a public token for your company. 4. Creates the hosting project, links it to the repository, sets its environment variables and gives it a public address with HTTPS. 5. Starts the first deployment in the background. If any step fails, Fluid undoes the steps that already finished, and the app shows as **Failed**. Nothing is left half-created. The app's address combines your company's subdomain and the app's slug, a six-character ID such as `3bed85`. You see the full address as **URL** on the [Mist Apps](/help/admin/settings/mist-apps) screen, or with `fluid mist show`. ### App states | State | What it means | | - | - | | `provisioning` | Fluid is setting the app up, and the first deployment hasn't been accepted yet. | | `live` | The app is set up. | | `failed` | Setup failed and was rolled back. Create the app again. | | `pending_destroy` | You deleted the app. You can restore it for 15 days. | | `archived` | The 15 days ended and Fluid is tearing the app down. | ## Environment variables Fluid sets Fluid sets and rotates these variables itself. They're marked **MIST** in the Mist desktop app and `managed_by: mist` in the API. You can't change or delete them. | Variable | When it's set | What it holds | | - | - | - | | `DATABASE_URL` | At create | The connection string for the app's production database. | | `FLUID_BASE_URL` | At create | Your company's Fluid address, such as `https://dunder-mifflin.fluid.app`. | | `FLUID_COMPANY_PRIVATE_TOKEN` | At create | A private API token for your company, for server-side calls to the Fluid API. Never send it to the browser. | | `FLUID_COMPANY_PUBLIC_TOKEN` | At create | A public token (`pub-`) that can read products, media, forms, playlists and enrollments. It's safe for client-side code. | | `FLUID_DROPLET_UUID` | When you add a droplet | The attached droplet's ID. | | `FLUID_DROPLET_SECRET` | When you add a droplet | The droplet's webhook secret. The template uses it as a fallback for lifecycle webhooks. | | `FLUID_WEBHOOK_AUTH_TOKEN` | When you add a droplet | The same secret. The template uses it to verify the droplet's install and uninstall webhooks. | | `FLUID_SESSION_TOKEN_SIGNING_SECRET` | When you add a droplet that has sign-in set up | The key that verifies viewer session tokens. Production only. | | `FLUID_OAUTH_CLIENT_ID` | When you add a droplet that has sign-in set up | The audience a session token must carry. Production only. | | `FLUID_SESSION_TOKEN_ISSUER` | When you add a droplet that has sign-in set up | The issuer a session token must carry. Production only. | | `FLUID_EGRESS_PROXY_URL` | When Fluid approves an egress proxy for the droplet | The proxy address for calls to systems that only accept Fluid's IP addresses. | When you list variables, Fluid hides the values of the secrets, such as `DATABASE_URL` and `FLUID_DROPLET_SECRET`. Your app still reads them at runtime. The template also reads `APP_URL`, the app's own public address, when it builds the URLs it registers with Fluid. You don't need to set it. Without it, the template uses the app's production address. ## Add your own environment variables Add a variable for anything your app needs, such as another service's API key. Your variables are encrypted. * **Mist desktop app**: right-click the app, click **Environment variables…**, then **Add variable**. * **CLI**: `fluid mist env set STRIPE_API_KEY=sk_live_51Hx…` * **API**: [Add a user-managed env var](/api-reference/mist_env_vars/add-a-user-managed-env-var). Keys use uppercase letters, digits and underscores, and start with a letter or underscore, such as `STRIPE_API_KEY`. A new or changed value takes effect on the app's next deployment. Publish again, or run `fluid mist push`, to apply it. To create a random secret, such as a signing key, let the CLI generate it: ```bash theme={null} fluid mist env set SESSION_SECRET --generate ``` The CLI prints the value once. Copy it then if you also need it locally. ### Use variables locally Locally, the app reads `.env.local`, which stays out of Git. Fluid stores your values encrypted and doesn't send them back, so keep your own copy of each value you need locally in `.env.local`. `fluid mist env pull` copies the values it can read into `.env.local` and keeps every line already in the file. It never copies a variable Fluid manages, such as `DATABASE_URL`, because local development uses the local database. It lists the encrypted variables it skipped, so you know which ones to add yourself. ## Compute Right-click a Mist app in the Mist desktop app and click **Compute** to choose how its server runs: | Option | How it behaves | | - | - | | **Fluid Compute** (default) | Keeps instances warm, so requests don't wait for a cold start. Scales with traffic. | | **Standard serverless** | Sleeps between requests. The first request after the app has been idle waits for a cold start. | Mist saves the choice in `vercel.json` in the app's repository. It applies on the next publish. **Compute** appears once the app is on your computer. ## Deployments Every push to the repository's `main` branch builds and deploys the app. You don't run a deploy step yourself. * **Mist desktop app**: click **Publish**. * **CLI**: `fluid mist push --watch` commits, pushes and follows the build. A deployment is `queued`, `building`, `ready`, `error` or `canceled`. To list recent deployments, run `fluid mist deployments`, or use [List recent deployments](/api-reference/mist_code/list-recent-vercel-deployments-for-the-mist). To go back to an earlier version, use **History** in the Mist desktop app, then publish. See [Roll back](/help/mist/run-and-publish#roll-back). ## Logs Build logs and runtime logs come from the same place: * **Mist desktop app**: click **Logs**, then the **Production** tab. * **CLI**: `fluid mist logs --tail` streams new entries. Add `--deployment ` to read one deployment's logs. What your code writes with `console.log` and `console.error` shows up here. ## Permissions Through the API and CLI, each action needs a `mist.*` permission on your token: | Permission | Lets you | | - | - | | `mist.view` | List and show apps. | | `mist.create` | Create and rename apps, and add integration points. | | `mist.destroy` | Delete and restore apps. | | `mist.code` | Clone and push code, and read deployments and logs. | | `mist.env_vars` | Read and manage environment variables and custom domains. | Mist API requests don't accept droplet installation tokens. ## Related pages * [Starter template](/mist-apps/starter-template) * [Billing](/mist-apps/billing) * [Run and publish](/help/mist/run-and-publish) in the Help Center This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.