Authentication

Available methods#

What each series accepts#

The two methods are not interchangeable across the whole API. An API key identifies the integration; a token also identifies the user and their company. Endpoints that need to know who performed the action — to resolve the company, to leave a trace, or to write a history — only accept the token.

Sending x-api-key to an endpoint that only accepts a token returns 401.

Each page's examples use the method that endpoint actually accepts. When in doubt, Authorization: Bearer works across the entire API.

Get credentials#

Request your credentials from your Nexcar contact or support@nexcar.mx. You'll get an api_key for production and another for the sandbox environment.

Never expose your api_key in browser-side code or commit it to a public repository.

Example: upload a document with API Key#

curl -X POST https://api.nexcar.mx/v1/documents \
  -H "x-api-key: your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "case_id": "11111111-2222-3333-4444-555555555555",
    "url": "https://your-storage.example.com/vehicle-invoice.pdf",
    "mime_type": "application/pdf",
    "type": "factura"
  }'

Example: create a case with Bearer Token#

curl -X POST https://api.nexcar.mx/v1/cases \
  -H "Authorization: Bearer your_jwt_token" \
  -H "Content-Type: application/json" \
  -d '{
    "internal_id": "EXP-2026-0001",
    "vehicle_origin": "Nacional",
    "status": "processing"
  }'

Authentication errors#