Getting started

Create a token, make your first call, and understand what the API can reach.

FLUF connects one account to every marketplace it supports. This API lets your own system drive that: list an item everywhere, change a price, find out what sold — without writing a single marketplace integration or ever touching marketplace credentials.

Base URL: https://fluf.io/wp-json/fc/api/v1

Get a token

1. In FLUF Connect, open More → Developers (open it)
2. Under API tokens, name the token (e.g. "Inventory sync") and click Create token
3. Copy it. It's shown once and starts with fluf_pat_

Send it on every request:

Authorization: Bearer fluf_pat_xxxxxxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

API access comes with the plan. There's no separate developer tier and no per-call fee. Pro plans (including Pro Legacy) get read-only access, and Super Seller gets read and write. Starter has no API access. See What's supported.

A token can do everything your plan allows, publishing and delisting included on Pro. Store it like a password and keep it server-side. Create a separate token for each integration so you can revoke one without touching the others.

There's no sandbox. Every write acts on real marketplace listings. Testing describes a safe way to try things out.

Your first call

Ask which marketplace accounts you can publish to:

curl "https://fluf.io/wp-json/fc/api/v1/accounts" \
  -H "Authorization: Bearer fluf_pat_your_token"

const res = await fetch("https://fluf.io/wp-json/fc/api/v1/accounts", {
  headers: {
    "Authorization": "Bearer fluf_pat_your_token",
  },
});

const data = await res.json();

import requests

res = requests.get(
    "https://fluf.io/wp-json/fc/api/v1/accounts",
    headers={
        "Authorization": "Bearer fluf_pat_your_token",
    },
)

data = res.json()

<?php
// composer require guzzlehttp/guzzle
$client = new GuzzleHttp\Client();

$res = $client->request('GET', 'https://fluf.io/wp-json/fc/api/v1/accounts', [
    'headers' => [
        'Authorization' => 'Bearer fluf_pat_your_token',
    ],
]);

$data = json_decode((string) $res->getBody(), true);

Each account comes back with an id like ebay:718 — the marketplace, then the connection. That id is what you name as a target when you publish. A seller with two eBay accounts has two entries, and they are not interchangeable.

What you can do

Create products, publish them to the accounts you name, edit and reprice them, take them down, and read back the state of every listing. Every endpoint is listed in the API reference. Reading and replying to buyer messages isn't covered — What's supported has the full list.

What a vid is

Products are addressed by a vid — a stable string identifying one product, whichever system it came from:

shopify_8123456789012_0     a product sourced from Shopify
fluf_326428506_0            a product created in FLUF

You'll see vids in every response. Pass them back verbatim; don't parse or construct them.

Know when something happens

Polling works, but you'll be late. Register a webhook and FLUF will POST to you the moment an item sells, a listing goes live, or a buyer messages you (on Depop and Vinted).

See Webhooks to register one and verify the signature, and the event reference for everything we send.

When you fall behind

If your endpoint was down, or you never saw a response, don't try to replay events — ask for current state:

curl "https://fluf.io/wp-json/fc/api/v1/items?updated_since=2026-08-01T00:00:00Z" \
  -H "Authorization: Bearer fluf_pat_your_token"

const res = await fetch("https://fluf.io/wp-json/fc/api/v1/items?updated_since=2026-08-01T00:00:00Z", {
  headers: {
    "Authorization": "Bearer fluf_pat_your_token",
  },
});

const data = await res.json();

import requests

res = requests.get(
    "https://fluf.io/wp-json/fc/api/v1/items?updated_since=2026-08-01T00:00:00Z",
    headers={
        "Authorization": "Bearer fluf_pat_your_token",
    },
)

data = res.json()

<?php
// composer require guzzlehttp/guzzle
$client = new GuzzleHttp\Client();

$res = $client->request('GET', 'https://fluf.io/wp-json/fc/api/v1/items?updated_since=2026-08-01T00:00:00Z', [
    'headers' => [
        'Authorization' => 'Bearer fluf_pat_your_token',
    ],
]);

$data = json_decode((string) $res->getBody(), true);

That returns only products that genuinely changed, so it stays quiet when nothing happened. It's the backstop for any gap: an outage your side, a bug in your consumer, or a cold start.

Machine-readable

Two OpenAPI documents, both public — no token needed to read them:

• openapi.yaml — the endpoints you call
• events.yaml — the events we send

Point a client generator at either.

Something missing? Email [email protected] — we prioritise by what people actually ask for.