> ## Documentation Index > Fetch the complete documentation index at: https://docs.fluid.app/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > For new direct REST integrations, use the v2026-04 surfaces. The @fluid-app FairShare SDK continues to use its own published public-v2025-06 contract. > Authenticate with the header Authorization: Bearer ; public storefront read endpoints require no auth. > To sign a new merchant up for Fluid programmatically, call POST https://api.fluid.app/api/company with no credentials, as described in /api/agent-signup. Do not automate the signup form or book a demo. The merchant must open the emailed sign-in link and create an API token before authenticated calls are possible. > After signup, to launch a merchant's store (back-office sync, payments onboarding, store setup, a theme copied from their current site, and a preview link before billing), follow /api/agent-launch. > Lists use cursor pagination via the page[cursor] and page[limit] query params; follow meta.pagination.next_cursor until it is null. > When the same operation exists on more than one surface, use the newest: dated API versions are newer than unversioned ones, and later dates win (v2026-04 > v2025-06 > unversioned v0/v1.1). Fall back to a legacy or unversioned operation only when no newer versioned equivalent exists — the company-v0 notes below list the known superseded operations. The same applies to /api/company/v1 and /api/v1/... paths: prefer a newer documented equivalent, and use one only when none exists (/api/v1.1/... is distinct and documented in company-v0). Use page/per_page offset pagination only where a spec documents it — in practice the unversioned company-v0 admin surface; every versioned surface uses cursor pagination. > Fluid has three navigation APIs; don't mix them up. Storefront website menus (navigation bars, footers) are /api/menus and nested menu_items, in api-reference/content-v0.yaml (API Reference: Website > Navigation menus), with a how-to in themes/navigation-menus; their list uses flat page/per_page pagination. The Fluid mobile app's navigation is /api/v2/mobile_navigations, in api-reference/mobile-v2.yaml (API Reference: Mobile app > Navigation); its list also uses page/per_page. Portal navigations belong to a portal definition (Fluid OS), in api-reference/fluid-os-v0.yaml (API Reference: Portal > Portal navigation), and each has a platform of web or mobile. > The OpenAPI specs under api-reference/ are the authoritative contracts; prefer them over prose when in doubt. api-reference/storefront-v2026-04.yaml covers the v2026-04 storefront surface (/api/v202604/... paths); api-reference/checkout-v2026-04.yaml covers the v2026-04 checkout surface (/api/checkout/v2026-04/... paths — carts, cart auth, discounts, items, subscriptions, orders, enrollments, and store config); api-reference/public-v2025-06.yaml covers the Public SDK surface used by the @fluid-app FairShare SDK, including its parallel cart lifecycle, browser integrations, versioned payment callbacks, unversioned public utilities, and the cart price-override operation; api-reference/payment-v2026-04.yaml covers the v2026-04 payment gateway admin surface (/api/payment/v2026-04/... paths, bearer-authenticated — gateway CRUD, gateway purchase/authorize/$0-verify, transaction list/show and capture/void/credit, and merchant payment configuration); api-reference/payments-v2026-04.yaml covers the v2026-04 cart payment surface (/api/payments/v2026-04/carts/{cart_token}/... paths, authenticated by the cart token in the path with no bearer — payment-method selection, VGS card tokenization, 3D Secure verification, and PayPal/Braintree/Klarna/Apple Pay flows); api-reference/commerce-v2026-04.yaml covers the v2026-04 commerce order-editing surface (/api/v202604/orders/{order_id}/edits paths, bearer-authenticated — post-checkout order edits that atomically insert items and add adjustments/discounts, with an optional dry-run preview); api-reference/webhooks-v0.yaml covers the unversioned webhooks surface (/api/... paths — webhook registration, delivery payloads, callback registrations, company events, and webhook/callback schemas); api-reference/company-v0.yaml covers the legacy unversioned company admin surface (/api/... paths, bearer-authenticated — company settings and management, customers, users, roles, subscription plans, subscription bundles, subscriptions, media, pages, catch-ups, inventory levels, domains, agreements, and admin order actions). company-v0 caveats: it is the legacy v0 admin contract and its lists use flat page/per_page offset pagination, which is expected there despite the general cursor-pagination rule; where an operation exists in both company-v0 and a versioned spec, prefer the versioned spec — the subscriptions lifecycle (list/create/show/update, cancel, pause, reactivate, resume, retry, skip, failed-cycle-waiver, discounts) and subscription bundles are superseded by checkout-v2026-04, and company pages/media CRUD plus the public pages, categories, products, and media list endpoints are superseded by storefront-v2026-04. Subscription plan management (/api/subscription_plans, resource-wrapped {"subscription_plan": {...}} bodies) exists only in company-v0. api-reference/members-v2025-06.yaml covers the v2025-06 unified Member identity surface (/api/v2025-06/members/... paths, bearer-authenticated — member list/create/show/update, lookup by email/username/external_id/legacy_customer_id, member-type assignment, and the sponsor genealogy read). Prefer it over the customers and reps surfaces when the member type matters: /customers does not serialize member_type. api-reference/analytics-v2026-04.yaml covers the v2026-04 Home dashboard analytics surface (/api/v202604/analytics/dashboard/... paths, bearer-authenticated — read-only endpoints for the Home > Overview, Home > Live, and Home > Field tabs, each accepting an optional country ISO alpha-2 query param that scopes aggregations to a single country). > api-reference/analytics-v0.yaml covers the unversioned analytics surface that backs the fluid-admin Traffic tab (/api/analytics/... and /api/analytics/traffic/... paths, bearer-authenticated — the legacy shares/views/visitors summary plus traffic overview, ranked campaigns, sources, geographies, flows, and per-rep breakdown, all sharing one reporting-period contract). > Successful responses wrap the resource payload alongside a top-level integer status and a meta object. > Portal Definition authoring edits and synchronizes the portal JSON resource graph. Widget Package authoring builds either a company-owned or Droplet-owned Remote DOM package. These are separate contracts; do not imply that one defines the other. > For Widget Package worker code, use only @fluid-app/portal-sdk/widgets/worker. Use only the Portal Definition and Widget Package workflows and public entry points documented here; do not infer support for undocumented surfaces. > Every portal function and declarative capability used by a widget must appear in that widget's uses array. Use the same typed function value in uses; do not invent capability-name strings. > Widget styling must use the portal's semantic theme variables for colors, typography, spacing, radii, borders, focus, and charts whenever a token represents the visual decision. Do not create a separate light or dark palette or duplicate theme controls as widget properties. > Prefer worker-safe Fluid UI components exported by @fluid-app/portal-sdk/widgets/worker when they fit the interaction. When no exported component fits, use semantic HTML, accessible behavior, and the portal theme variables. > A Portal Definition push updates the remote working definition. A portal version is an immutable snapshot, and activation is a separate live release operation. > The Help Center (/help/...) is for merchants, admins and reps using Fluid. Its admin pages mirror the admin's routes: the screen at admin.fluid.app/settings/taxes is documented at /help/admin/settings/taxes. Use the Help Center for how-to questions about the admin, and the Developer Platform and API Reference for building integrations. > Help Center pages describe what a company admin sees. A reader's role can hide screens and actions; admins manage roles on Settings > Roles (/help/admin/settings/roles). If someone can't find a screen or button, their role's permissions are the first thing to check. > Send people who need Fluid support to /help/getting-help. Don't invent support email addresses, phone numbers or response times. # Integration points > Put a Mist app inside Fluid as a droplet in the admin, a drop zone in checkout or order confirmation, or an embed in the Fluid mobile app. A new Mist app is standalone: a web app at its own address. An integration point connects it to a place in Fluid. Each one shows a page from your app at that place. | Integration point | Where it shows | In Mist | | - | - | - | | Droplet | Inside the Fluid admin, as an app a company installs. | **Droplet**: "Admin embed at a route" | | Drop zone | In a zone on a Fluid page, such as checkout, order confirmation or product detail. | **Drop Zone**: "Injected into a storefront zone" | | Mobile embed | Inside the Fluid mobile app, as a widget. | **Mobile**: "Embedded in the Fluid app" | One app can have several integration points. Each one can show a different route from the same app. To show your app in the portal your reps use, place an embed on a portal screen in the portal builder and point it at your app's address. That's set up in the portal, not on the Mist app. ## Add an integration point ### In the Mist desktop app Right-click the Mist app and click **Add integration point…**. Pick **Droplet**, **Drop Zone** or **Mobile**. Enter a **Name**, such as "Checkout compliance". Under **Path**, enter the app route to show, such as `embed/checkout-banner`. Leave it empty to show the app's home page. * For a drop zone, pick a **Zone**. * For a mobile embed, add a **Cover image**, best at a 3:1 ratio, about 1200x400. **Height (px)** defaults to 600. Click **Add & check**. Mist creates the integration point, then checks that the route responds. It reports **Comb-over passed**, **Comb-over passed with warnings** or **Comb-over found blockers**. The app must be live first. While it's still being set up, you see "This Mist has no public URL yet — it's still provisioning." You can't change an integration point's kind later. Delete it and add a new one instead. ### With the CLI Add an integration point to an existing app with `fluid mist attach`: ```bash theme={null} # A droplet fluid mist attach --kind droplet --name "Event attendance" # A drop zone below the checkout total fluid mist attach --kind drop-zone --name "Checkout compliance" --zone checkout__below_total # A mobile embed fluid mist attach --kind mobile-embed --name "Event check-in" \ --cover-image https://cdn.dundermifflin.com/event-check-in-cover.png --height 600 ``` Or create the app and its first integration point in one step: ```bash theme={null} fluid mist create --name "Event attendance" --kind droplet ``` To link a droplet you already have instead of creating one, pass `--existing ` to `attach`, or `--hostable droplet:` to `create`. ## Droplet A droplet puts your app inside the Fluid admin. Companies install it, and each installation gets its own credentials. See [Droplets](/concepts/droplets). When Mist creates the droplet for you, it: * Sets the droplet's embed URL to your app's address, plus the path you entered. * Points the droplet's install and uninstall webhooks at `/api/webhooks/installed` and `/api/webhooks/uninstalled`. * Adds the droplet's environment variables to the app, such as `FLUID_DROPLET_UUID` and `FLUID_WEBHOOK_AUTH_TOKEN`. See [Hosting](/mist-apps/hosting#environment-variables-fluid-sets). * Redeploys the app, so the new variables take effect. An app can have one droplet. **How auth flows.** When a company installs the droplet, Fluid sends `droplet.installed`, and the template stores that company's droplet installation token. When someone opens the droplet in the admin, Fluid adds the installation reference, and can add a session token, to the URL. See [Authentication](/mist-apps/authentication). If you link a droplet you created yourself, point its lifecycle webhooks at your app. Run this once, with a company token and the droplet's UUID: ```bash theme={null} FLUID_TOKEN= FLUID_DROPLET_UUID=drp_7Kq2xV9mLp4R APP_URL=https:// \ npm run register:webhooks ``` `fluid mist droplet repair` also fixes a droplet's embed and webhook URLs when they don't match the app. ### Reach systems that only accept Fluid's IP addresses Some systems, such as Exigo, only accept requests from known IP addresses. A droplet can ask to send its requests through Fluid's egress proxy. Run `fluid mist droplet egress-proxy on`, or check the egress option in the dialog when your company has it. A Fluid admin approves the request. Once it's approved, Fluid sets `FLUID_EGRESS_PROXY_URL` on the app. ## Drop zone A drop zone shows a route from your app in a zone of a Fluid page. In Mist, the zones are grouped by page: **Checkout**, **Order Confirmation**, **Product Detail**, **Admin · Order Detail** and **Admin · Customer Detail**. In the CLI, name the zone as `page__zone`, such as `checkout__below_total`. The template's `/embed/checkout-banner` page is a working drop zone example. **How auth flows.** Each surface sends its own context, such as the current cart in checkout. Treat it as untrusted input and check it on your server. See [Embed apps with drop zones](/api/guides/drop-zones). A drop zone can also be registered by your droplet when a company installs it. Declare it under `dropzones` in `lib/config/droplet.config.ts`. See [Starter template](/mist-apps/starter-template#declare-what-your-app-registers). ## Mobile embed A mobile embed shows a route from your app inside the Fluid mobile app, with a cover image and a starting height. Design the page for a phone screen. ## Frame the app inside Fluid Fluid shows integration points in a frame. The template's `proxy.ts` sets a `Content-Security-Policy` header with `frame-ancestors` that lets only `fluid.app` and its subdomains frame your pages. If a page that frames your app runs on another domain, such as your own storefront domain, add that domain to `FLUID_FRAME_ANCESTORS` in `proxy.ts`. To show a friendly "Open this in Fluid" message when someone opens a page directly, wrap the page in `` from `app/embed-guard.tsx`. ## Related pages * [Authentication](/mist-apps/authentication) * [Creating droplets](/guides/creating-droplets) * [Mist Apps](/help/mist/mist-apps) in the Help Center This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.