Nexus ERP / Docs

API keys

Create, manage, and revoke keys for the API.

API keys let scripts and integrations talk to your organisation's data through the API. Keys are scoped: each one carries its own permissions and (optionally) an expiry date. The developer documentation (endpoint reference, request format, scopes) appears in the docs sidebar for users holding the Developer permission.

A key can do what you tick, as anyone in the workspace

A key acts with full authority inside the permissions you tick for it: it is not limited to what you can do on screen. A key with the invoices and users boxes ticked can read every invoice and every member in the workspace, whoever created it. Tick only what an integration needs, and give Developer Access only to people you trust with full access.

Creating a key

  1. Open Dashboard → Developer.
  2. Click New key (top-right).
  3. Fill in:
    • Key name, a label for you, e.g. "Zapier, leads sync". 1–100 characters, required.
    • Permissions, tick the boxes for what the key can do: one row per resource (leads, tasks, invoices, ...) with read / create / update / delete toggles. Default: all unticked.
    • Expiry, optional. If set, the key stops working after that date.
  4. Click Create key.

A modal appears showing the raw key, masked by default. Click the eye icon to reveal, then Copy it.

You only see the raw key once

We never store the plaintext, only a SHA-256 hash. If you lose the key, you can't recover it, you'll need to make a new one. Save it in your password manager or your CI's secret store before closing the dialog.

Using a key

Send it as a Bearer token in the Authorization header:

Authorization: Bearer sk_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The first 14 characters (sk_xxxxxxxx_...) are your key prefix, you'll see this on the keys list, in the audit log, and in error messages. The prefix alone can't be used to authenticate.

Editing a key

The keys list shows every key in the workspace with who created it, but you can change, revoke or delete only the keys you created. Owners can manage every key. Click one of your own rows to change:

  • Name, relabel the key any time.
  • Permissions, tick / untick boxes.

You can't change the expiry once a key is created.

Revoking a key

Two options:

  • Revoke, marks the key inactive. Requests with it will get a 401. The key stays in the list for audit purposes.
  • Delete, permanently removes the key. Once deleted there's no history of it ever existing (apart from audit log entries).

Revoke first when in doubt, it's reversible (we can re-activate). Delete only when you're sure.

Temp keys from the docs playground

When you click Generate test token on an API endpoint page in the docs, the system creates a 1-hour key on your behalf, named "Docs playground (temp: <resource>)". These show up in the same keys list, scoped to full CRUD on just that endpoint's resource, and auto-expire. Revoke them early if you're worried. The docs page keeps the token in your browser for your own account only, and forgets it when you sign out or sign in as someone else.

Permissions you'll need

You need the Developer permission, and the workspace must be on the plan tier that includes the Custom API (partner orgs can additionally create partner-scoped keys on any tier).