nextX
← Docs

Open API · API Key

Issuing and managing API keys

For NextX CRM administrators. Once you issue a key to a partner, their website can push leads straight into your CRM with no manual data entry.

Open the developer integration guide

What an API key is

A string that stands in for a login when two systems talk to each other.

An API key is a string that stands in for a login when two systems talk to each other. The key is bound to your workspace: data lands only in your company, and the partner cannot see or touch any other workspace.

The key works on the CRM integration API: push leads in, read the field schema, read the customer list and customer details, and update a customer by phone number (it only overwrites the fields you send). There is no delete operation. Keys created from the CRM settings screen are currently not restricted to specific permissions, so they can use this whole API.

Anyone holding the key can push data into your CRM and read your customer list. Treat it like a password: send it only to the partner's technical contact, over a private channel.
1

Create a key

Sign in to NextX CRM with an administrator account.

  1. · Open Settings (the System group at the bottom of the left sidebar).
  2. · Pick the CRM group → API Keys & Webhooks.
  3. · Click Create key and name it after the partner (e.g. “ABC Securities website”).
  4. · Copy the key shown and store it right away.
The key is shown exactly once. Close the dialog and it is gone — your only option then is to create a new key and revoke the old one.

New keys look like nxk_ + 72 characters (the tail is a checksum, so a single typo is rejected immediately). The list shows only the beginning (e.g. nxk_3f9a) so you can tell keys apart. Keys created before 14/10/2026 (64 characters, no nxk_) keep working.

Only accounts holding iam.api_keys.manage can view, create and revoke keys. Regular staff never see this screen.

2

Hand the key over

Send two things: the key you just created, and a link to the developer integration guide.

Send the key and the documentation through different channels — for example the guide by email and the key by direct message to the technical contact.
Open the developer integration guide →
3

Check that data arrives

Ask the partner to push one test lead.

  1. · Open Contacts in the CRM and sort by newest.
  2. · The new record appears with the source the partner declared (e.g. Website).
  3. · Check the owner column — the system assigns it using your lead distribution settings.
Without lead distribution configured, leads are still saved but have no owner yet.

Custom fields

To capture more than name, phone and email — say a product line, a service tier, or a referrer code — create the custom field first.

  1. 1. Settings → CRM → Custom fields.
  2. 2. Create the field with a suitable name and type.
  3. 3. Tell the partner to re-fetch the schema — the new field code shows up immediately.
No need to read field codes over the phone: there is an endpoint that returns your company's exact field list.

Revoke a key

Revoke as soon as: the partnership ends, their technical staff leaves, or you suspect the key leaked.

  1. 1. Go to Settings → CRM → API Keys & Webhooks.
  2. 2. Find the key by name or by its first 8 characters.
  3. 3. Click Revoke and confirm.

The key stops working almost immediately and every request using it is rejected. Data already pushed in stays untouched.

To rotate without downtime: create the new key, send it over, wait for the partner to confirm the switch, then revoke the old one.

Connect n8n / Make

No code: use the built-in HTTP node and send the API key in a header.

  1. 1. n8n: add an HTTP Request node. Make: add the HTTP › Make a request module.
  2. 2. Method POST, URL https://api.nextx.vn/api/v1/crm/integrations/leads (or another endpoint from the API reference).
  3. 3. Header X-Api-Key = the workspace API key; Content-Type: application/json.
  4. 4. JSON body per endpoint — e.g. a lead: full name, phone, email, source.
Keep the API key in Credentials (n8n) / Keys (Make), not pasted into the node. Send an Idempotency-Key on writes so re-runs do not create duplicates.

FAQ

The questions that come up most when a key is first issued.

If the partner sends the same person twice, do I get duplicates?

No. Duplicates are detected by the partner's reference id first, then by phone number, and the existing record is returned instead of a new one.

Are phone numbers in +84912… format accepted?

Yes. 84912… and +84912… are normalised to 0912… so they match your existing data.

Should a partner get more than one key?

Prefer one key per system — website and mobile app get separate keys. Revoking one then affects only that system.

Can the partner read my customer data once they have a key?

Yes. A key created from the CRM settings screen can read the customer list and customer details (GET /api/v1/crm/integrations/contacts) and update a customer by phone number. Only give a key to systems you trust, and revoke it as soon as it is no longer needed.

What if I closed the dialog before copying the key?

Create a new key and revoke the old one. There is no way to view a key again.

The lead is in the CRM but my staff cannot see it.

Check your lead distribution settings and that user's data scope. The lead is always stored; who sees it depends on view permissions and ownership.

Quick reference

Where each task lives in the app — quick lookup.

TaskWhere
Create or revoke an API keySettings → CRM → API Keys & Webhooks
Add a custom fieldSettings → CRM → Custom fields
Configure lead distributionCustomers → Lead distribution
See incoming leadsCustomers → Contacts