API Keys

Generate and manage API keys for programmatic access to the NexusCommerce REST API.

Overview

The API Keys settings page lets you generate bearer tokens for programmatic access to the NexusCommerce REST API. Use API keys for integrations, automation scripts, CI/CD pipelines, and custom tooling that needs to interact with NexusCommerce without a user session.

Key Concepts

API Key — A long-lived bearer token scoped to a specific tenant. API keys act on behalf of the tenant (not a specific user) and have a configurable permission scope.

Tenant ID — Your tenant identifier, required in the X-Tenant-ID header on every API request. Found on this page.

Scope — The set of permissions granted to an API key. Scopes follow the pattern resource:action:

Scope	Description
`products:read`	Read product catalog
`products:write`	Create and update products
`orders:read`	Read orders
`orders:write`	Update order status, confirm shipments
`inventory:read`	Read inventory levels
`inventory:write`	Update inventory quantities
`pricing:read`	Read pricing rules and recommendations
`pricing:write`	Create and update pricing rules
`analytics:read`	Query analytics data
`ai-jobs:write`	Dispatch AI worker jobs
`*`	Full access (use with caution)

Getting Started

Navigate to Settings > API Keys.

Generate an API Key

Click Generate New Key
Enter a descriptive name (e.g., "Warehouse Integration", "CI Pipeline")
Select the required scopes
Set an expiry (optional — leave blank for no expiry)
Click Generate
Copy the key immediately — it is only shown once

Using an API Key

Include the key in the Authorization header and your tenant ID in the X-Tenant-ID header on every request:

curl https://your-nexuscommerce.com/api/products \
  -H "Authorization: Bearer nxc_live_abc123..." \
  -H "X-Tenant-ID: 3714240b-2e06-4c35-8856-ccc1c096323e"

Features

API Key List

The API Keys list shows all active keys:

Column	Description
Name	Descriptive name you assigned
Prefix	First 8 characters of the key (for identification)
Scopes	Granted permission scopes
Created	Creation timestamp
Last Used	Last API call timestamp
Expires	Expiry date (or "Never")
Actions	Revoke

Tenant Information

At the top of the API Keys page:

Tenant ID: 3714240b-2e06-4c35-8856-ccc1c096323e (use in X-Tenant-ID header)
API Base URL: https://your-nexuscommerce.com/api

Key Rotation

To rotate an API key:

Generate a new key with the same scopes
Update your integration to use the new key
Verify the new key is working
Revoke the old key

There is no in-place rotation — you must generate a new key and revoke the old one manually.

Revoking a Key

Click Revoke on a key to permanently invalidate it. Revocation is immediate — any in-flight requests using the revoked key will receive a 401 response on the next request after revocation.

Configuration

Setting	Description	Default
Key format	Key prefix for identification	`nxc_live_` (production), `nxc_test_` (staging)
Max keys per tenant	Maximum number of active API keys	20
Key expiry options	Selectable expiry windows	30d, 90d, 1y, Never
IP allowlist (Enterprise)	Restrict key usage to specific IP ranges	None

On this page