# Ways to use Vabu OS

Pick the mode that matches what you already have. Modes combine per tenant and per product. For example, a tenant can use Vabu ID for login and Vabu's checkout for tickets, and take payment its own way for a stream.

| Mode | You bring | Vabu OS provides | Example |
|---|---|---|---|
| A. Infrastructure API | Your app, users, payments and access rules | Service infrastructure through the API | A streaming platform |
| B. Own accounts | Your own login | Everything else, acting for the customers you name | A club app with existing logins |
| C. Own payments | Your payment stack | Access, streams and the rest. You tell Vabu who has paid. | A platform with its own payment provider |
| D. Whitelabel | Brand, domain and content | Login, checkout and the product APIs | A ticketing brand |
| E. Internal | Nothing | Everything | Vabu's own apps |

## A. Infrastructure API

Call the API from your server with a [secret or restricted key](https://docs.vabu.live/concepts/keys-and-scopes.md). Your users stay yours: send `external_id` on any object, and read [metadata and external_id](https://docs.vabu.live/concepts/metadata.md). You do not need to create Vabu accounts for them.

## B. Own accounts

You keep your login. Your server says who the customer is, in one of two ways:

- From your server, name the customer with your own id in the request.
- From a browser, send a [customer token](https://docs.vabu.live/concepts/customer-tokens.md) that your server signs, with a publishable key.

This works for Streams and Access today. Signing in to the other products with tokens from your own identity provider is on [What's coming](https://docs.vabu.live/whats-coming.md). See [sign-in options](https://docs.vabu.live/concepts/sign-in-options.md).

## C. Own payments

You collect the money your own way, and then tell Vabu who may use what. For Streams and Access that is one call after each payment:

```http
POST /v1/access/entitlements
Idempotency-Key: grant-pay-8842

{ "customer": "user_42", "resource": { "type": "ls", "id": "ls_..." },
  "source": "tenant_grant", "source_ref": "pay-8842", "ends_at": "2026-11-02T18:30:05Z" }
```

No Vabu balance is created and there is no payout. See [paid access](https://docs.vabu.live/guides/streams/paid-access.md).

For orders in Events and Commerce, Vabu collects the payment through its checkout today. Reporting payments you collected yourself, so that an order completes, is on [What's coming](https://docs.vabu.live/whats-coming.md).

## D. Whitelabel

You supply a brand, a domain and content. Login is Vabu ID, payment is Vabu's checkout and the product APIs are the same ones everyone uses. Branding such as logo, colours and sender names is read from your tenant and organization. Your app calls the API and shows the result.

## E. Internal

Vabu's own apps are tenants too. They use the same public API as you, with every product switched on.

## Products

The products are Events, Fanbases, Commerce, Streams, Promoters, Messaging, Payments, Identity and Insights. See [products](https://docs.vabu.live/products/index.md) for each one. Each tenant has Streams switched on separately: a Streams route that is off returns `403` with the code `product_not_enabled`. Keys carry product scopes.

## What Vabu uses behind each product

You do not pick these yet. They are what Vabu runs for you, so you know what to expect.

| Concern | What Vabu uses |
|---|---|
| Identity | Vabu ID, which also accepts Payd ID tokens |
| Payments | Payd checkout, with M-Pesa first |
| Streams | One video network that Vabu picks for your account. The `provider` field on each stream shows it. |
| Messaging | WhatsApp, SMS and email, sent by Vabu's own senders |

Choosing a network for each stream is on [What's coming](https://docs.vabu.live/whats-coming.md).

Whatever the mode, Vabu sends an [event](https://docs.vabu.live/concepts/webhooks.md) for what happens, so webhooks work the same in every mode.