Authentication
Every request carries a bearer access token obtained with your app credentials.
Client credentials
Each app has a client ID and a client secret. Post them to the token URL (https://api.zahrex.com/v1/oauth/token) with grant type client_credentials. Send the credentials either as HTTP Basic auth or in the request body.
API keys
Your app credentials identify it as a test or live app. Key prefixes: zx_live_, zx_test_. Test apps are for development and never trigger live webhooks; use a live app in production.
Token lifetime
Access tokens last 3600 seconds. Request a new one when it expires; do not store tokens long term.
Keep secrets safe
- Never put the client secret or a token in a web page, mobile app or public repository.
- Call the API from your server and keep secrets in environment variables.
- Rotate the secret from the app page in Zahrex if it may have leaked.
Scopes
A token can only call endpoints whose scope the app was granted.
| Scope | Allows |
|---|---|
events:write | Send subscription, booking, form and custom events. |
customers:write | Create or update customers. |
leads:write | Create leads. |
orders:write | Send orders and their payments or refunds. |
catalog:read | Read the organization's service and product catalog. |
customers:read | Look up a customer by phone or email. |