Apps & OAuth

Pick an authentication method

API key →

Get an access token (client credentials)

Once a workspace installs your app, your server exchanges client_id + client_secret for a token per workspace.

curl -X POST https://api.nextx.vn/api/v1/iam/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "workspace_id=WORKSPACE_GUID" \
  -d "scope=crm.contacts.view sales.orders.view"

Response:

{
  "access_token": "eyJhbGciOiJSUzI1Ni...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "crm.contacts.view sales.orders.view"
}

• The granted scope = requested ∩ allowed (app) ∩ granted (workspace consent).
• The response carries a refresh_token field but it is always empty — it cannot renew anything. When the token expires, call this endpoint again.
• workspace_id = the GUID of the workspace that installed the app (one token per workspace).

Install link and consent

Workspaces install your app from its install link; the consent screen lists exactly the scopes the app requests. Try it on your own workspace in Development mode, then Publish so other customers can install it.

Scopes (permissions)

A scope is a permission code shaped like service.resource.verb, where the verb is view (read) or manage (write). The app only requests scopes; only the workspace can grant them.