> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fluz.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Operate on your customers' accounts

> Register or connect your customers, get a token scoped to each of them, and run the exact same APIs you already use on your own account.

## Two token paths, one API

<Columns cols={2}>
  <Card title="Your own account" icon="user" href="/get-started/api-credentials">
    `API credentials` → `Your token`

    You use API keys to mint a User Access Token for your account.
  </Card>

  <Card title="A customer's account" icon="users" href="/client-facing-o-auth-grant-flow">
    `OAuth grant` → `Their token`

    Customers authorize your app, and Fluz returns a token scoped to their account.
  </Card>
</Columns>

<Note>
  From there, `createVirtualCard` is `createVirtualCard` — no separate platform API to learn.
</Note>

## Onboard and connect customers

<Steps>
  <Step title="Create your OAuth app" icon="app-window">
    Configure your app, redirect URIs, and scopes in the dashboard. [Create an OAuth app →](/create-an-o-auth-app)
  </Step>

  <Step title="Register or connect the customer" icon="id-card">
    New customers: register individuals or businesses with built-in KYC and KYB. Existing Fluz users: send them through the grant flow. [User registration →](/user-registration) · [KYC verification →](/user-kyc-verification)
  </Step>

  <Step title="Exchange the grant for a token" icon="key">
    The customer authorizes your app; you exchange the code for a token scoped to their account. [Grant flow →](/client-facing-o-auth-grant-flow) · [Exchange the code →](/exchange-an-o-auth-authorization-code)
  </Step>

  <Step title="Run the APIs you already know" icon="play">
    Send the customer-scoped token instead of your own. Everything else is identical. [Refresh tokens →](/refresh-o-auth-access-token)
  </Step>
</Steps>

## What you can do on connected accounts

Every capability applies as written when you use a customer-scoped token.

<CardGroup cols={3}>
  <Card title="Virtual cards" icon="credit-card" href="/features/virtual-cards" />

  <Card title="Gift cards" icon="gift" href="/purchase-gift-card" />

  <Card title="Wallets & transfers" icon="wallet" href="/features/spend-accounts" />

  <Card title="Funding sources" icon="coins" href="/features/funding-sources" />

  <Card title="Transactions" icon="list" href="/features/get-all-transactions" />

  <Card title="Authorized users" icon="users" href="/features/create-authorized-users" />
</CardGroup>

## Take your app live

Anything you build against your **own** account needs nothing from us. Certifying a **public** app — one that operates on other verified Fluz accounts — requires a due diligence review first.

<Steps>
  <Step title="Handle account opening and management" icon="id-card">
    Register and verify your customers, or connect existing Fluz users through the grant flow. [User registration →](/user-registration) · [KYC verification →](/user-kyc-verification) · [Business registration →](/business-registration)
  </Step>

  <Step title="Build your core capabilities" icon="hammer">
    Implement the capabilities your app needs in staging using a customer-scoped token. Every capability behaves exactly as documented on your own account.
  </Step>

  <Step title="Complete the due diligence form" icon="clipboard-check">
    Submit the form or forms below that apply to your program. Our team reviews the submission and approves your application.
  </Step>

  <Step title="Go live" icon="rocket">
    We certify your public app and release production credentials. [Deploying to production →](/deploying-to-production)
  </Step>
</Steps>

## Due diligence

<Warning>
  **Platform due diligence is only required to operate on other verified accounts. You do not need it to build an application on your own account for your own activity.** Specialized verticals are the exception — those programs are reviewed regardless of whose account you operate on.
</Warning>

<Card title="Operating on behalf of your customers" icon="users" horizontal href="https://form.jotform.com/261725180124046">
  Required if you are embedding Fluz to operate on behalf of your customers. Complete the platform due diligence form →
</Card>

<Card title="Specialized verticals" icon="scale" horizontal href="/specialized-verticals">
  Gaming, prediction markets, sweepstakes, and money services businesses follow an enhanced review path before going live. See the process, the timeline, and the form for your vertical →
</Card>

<Card title="Direct card interaction (PCI)" icon="shield-check" horizontal href="https://form.jotform.com/262074914005047">
  Required if you will interact directly with cards we issue, or pass us the actual cards of your users. You must be PCI compliant. Form link coming soon.
</Card>

<Card title="Custom card art" icon="palette" horizontal href="/custom-card-art">
  Required if cards will carry your brand instead of the standard Fluz design. Bank and network approval adds 6–8 weeks — see the specifications and the submission process →
</Card>

We need these completed before we can certify your public app to go live.

We need these completed before we can certify your public app to go live.