Getting started

The NEXTOREx API lets your own software read and write the same business data your team works with in NEXTOREx: CRM leads, ERP customers and products, Education students, and your NEXTOREx subscription and invoices. This page takes you from nothing to your first successful call.

The integration journey

1. Developer API access. Developer API is a premium platform capability. It must be enabled on your NEXTOREx account before keys can be created or used. It is not a fourth application: your ERP / POS, CRM and Education plans work exactly as before.
2. Create an API key. A user with the API key permission opens the dashboard, chooses a company, a place in your organisation tree, a role and the scopes the integration needs, then creates the key.
3. Copy the secret once. The full key is displayed a single time. NEXTOREx stores only a one-way hash, so it cannot show it again.
4. Store it securely. Keep it in a server-side secret store or environment variable. Never put it in a mobile app, a browser page or a public repository.
5. Send it as a Bearer token on every request: Authorization: Bearer <your-api-key>.
6. Call /me to confirm the key works and to see exactly what it may do.
7. Read data from the endpoints you have a scope for.
8. Write data where you hold a write scope. Writes are small and controlled; they are not full CRUD.
9. Send an Idempotency-Key on every POST so a retry can never create a duplicate.
10. Handle pagination, errors and rate limits (see the dedicated pages).
11. Optionally receive webhooks so you are told when things change instead of polling.

Your base URL

All paths in this guide are relative to:

https://api.nextorex.com/api/public/v1

First call

curl "https://api.nextorex.com/api/public/v1/me" \
  -H "Authorization: Bearer nx_live_xxxxxxxxxxxx_YOUR_SECRET_HERE" \
  -H "Accept: application/json"

A successful response describes the key, never any database identifier:

{
  "data": {
    "key": {
      "name": "Website lead sync",
      "prefix": "xxxxxxxxxxxx",
      "environment": "live",
      "scopes": ["crm:read", "crm:write"],
      "expires_at": "2027-10-19T09:00:00+00:00"
    },
    "tenant": { "name": "Example Traders", "slug": "example-traders" },
    "company": { "name": "Example Traders (Pvt) Ltd", "code": "EXT" },
    "hierarchy": { "level": "company", "name": "Head Office" },
    "role": { "name": "Integration" },
    "rate_limits": { "per_key_per_minute": 60, "per_tenant_per_minute": 180 }
  }
}

Then read something

curl "https://api.nextorex.com/api/public/v1/crm/leads?limit=5" \
  -H "Authorization: Bearer nx_live_xxxxxxxxxxxx_YOUR_SECRET_HERE"

See Reading data for every endpoint, filter and sort, and Writing data for creating and updating records.

What the API will not do

Version 1 is deliberately small and safe. It does not delete anything, does not move money, does not change subscriptions, and does not expose payroll, staff, stock levels or accounting entries. The full list is on Writing data.