Authentication

Every Fluz API request carries a user access token in the Authorization header. How you get that token depends on whose account you’re operating on.

​

Two paths, one API

Once you hold a token, the rest of the API is identical. createVirtualCard on your token creates a card on your wallet; createVirtualCard on a customer token creates it on theirs.

​

Path 1 — your own account

1. In the dashboard, create an application and copy its API Key, User ID, and Account ID.
2. From your backend, call generateUserAccessToken on https://transactional-graph.fluzapp.com/api/v1/graphql (staging: https://transactional-graph.staging.fluzapp.com/api/v1/graphql) with the header Authorization: Basic <API_KEY>, passing your userId, accountId, and the scopes you need as arguments.
3. Attach the returned token as Authorization: Bearer <token> on every request to the transactional graph.

See API credentials for a full example.

​

Path 2 — a customer’s account

Use this when you’re building a platform — e.g. issuing cards on behalf of your users.

1. Redirect the customer to Fluz’s OAuth authorize URL with your clientId, requested scopes, and redirect_uri.
2. The customer signs in and grants your scopes.
3. Fluz redirects back with a short-lived authorization code.
4. Your server exchanges the code for a customer-scoped access token at the OAuth token exchange endpoint — see the OAuth grant flow.
5. Refresh customer-scoped tokens via the OAuth token refresh endpoint without re-prompting the customer.

Full walkthrough in Build a platform.

​

Scopes

Tokens carry an explicit set of scopes. Common ones by capability: Request the minimum you need. Mint a new token when you need broader access.

​

Token lifetime

• Access tokens: short-lived JWTs (minutes, not hours). Mint a new one when it expires — see Replace an expired access token.
• OAuth customer tokens: refreshable via the OAuth token refresh endpoint.
• Application API key: valid until rotated in the dashboard.

​

Next steps