Authentication · Nexcar API Docs

The API supports two authentication methods. Pick the one that fits your integration best.

Available methods#

Method	Header	Recommended for
API Key	`x-api-key: <api_key>`	Long-lived server-to-server integrations
Bearer Token (JWT)	`Authorization: Bearer <token>`	Integrations where the token is rotated per session

Every endpoint under /v1/cases and /v1/documents accepts at least one of the two methods.

Get credentials#

Request your credentials from your Nexcar contact or support@nexcar.mx. You'll get an api_key for production and another for the sandbox environment.

Never expose your api_key in browser-side code or commit it to a public repository.

Example: upload a document with API Key#

curl -X POST https://api.nexcar.mx/v1/documents \
  -H "x-api-key: your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "case_id": "7040fd87-5f49-4187-b2a3-b4a19670825c",
    "url": "https://your-storage.example.com/vehicle-invoice.pdf",
    "mime_type": "application/pdf",
    "type": "factura"
  }'

Example: create a case with Bearer Token#

curl -X POST https://api.nexcar.mx/v1/cases \
  -H "Authorization: Bearer your_jwt_token" \
  -H "Content-Type: application/json" \
  -d '{
    "internal_id": "EXP-2026-0001",
    "vehicle_origin": "Nacional",
    "status": "processing"
  }'

Authentication errors#

HTTP	Code	Cause
`401`	`UNAUTHORIZED`	Header missing or token expired
`401`	`INVALID_CREDENTIALS`	Invalid API key or malformed token
`403`	`FORBIDDEN`	Credentials are valid but lack permission on the resource