Quickstart
Get from zero to a successful API call in five minutes.
1. Mint an API key
Sign in at cardnexus.com, open Settings → API keys, and click Create key. Pick a descriptive name ("alphabay-inventory-sync"), select the scopes the integration needs, and submit.
The plaintext key is shown once — copy it immediately and store it somewhere safe (your secret manager, a password manager, a deployment env var). CardNexus never displays it again.
API key tokens look like this:
cnk_live_4f2d8c91e5b34a7f9e6c2d1a8b5f7e3c
Every key is prefixed cnk_live_.
2. Verify the key
Hit GET /v1/account/me to confirm the key works and the right account is on the other side of it:
curl https://public-api.cardnexus.com/v1/account/me \
-H "Authorization: Bearer cnk_live_4f2d8c91e5b34a7f9e6c2d1a8b5f7e3c"
Successful response (200 OK):
{
"id": "65f3a2b1c8d4e9f7a6b5c4d3",
"email": "alex@alphabay-cards.example",
"username": "alphabay_cards",
"createdAt": "2024-08-14T10:23:11.000Z"
}
If you get 401 Unauthorized, the key is missing, malformed, or revoked — check the header value. If you get 403 Forbidden, the key was minted without the account:read scope; either rotate it or use a key that has the scope.
3. Read the response headers
Every successful response carries a few headers you should pay attention to:
| Header | Meaning |
|---|---|
X-Request-Id |
Unique per request. Quote this when contacting support. |
X-RateLimit-Limit |
The applicable limit. |
X-RateLimit-Remaining |
Requests left before the limit resets. |
X-RateLimit-Reset |
Epoch seconds when the limit window ends. |
Exceed the limit and you get 429 Too Many Requests plus a Retry-After header. See Rate limits.
4. Next steps
- Add error handling for the error envelope shape.
- Decide which scopes your production keys actually need — the smaller, the better.
- Walk through Sync inventory for a full integration template.