Access to the NX Restaurant (NXR) API is restricted to approved integrators.

Integrators are issued a unique NXR Integrator Client ID and NXR Integrator Client Secret upon approval.

These credentials are required for all requests to the API.

Authentication

The NX Public API authenticates using OAuth 2.0 Client Credentials. In short: you trade a client ID and secret for a short-lived access token, then include that token on every API call you make.

A couple of things make this slightly different from a textbook OAuth setup, worth knowing up front:

• Tokens are venue-pinned. When you request a token, you also tell us which venue you're requesting it for. The token is only valid for that venue — even if you manage several venues, you'll need a separate token per venue.
• Tokens are short-lived — 15 minutes — and there's no refresh token. There's nothing to "refresh"; just request a new one the same way you got the first one. Most integrations request a token once per session and re-request shortly before it expires, rather than fetching a new token per API call.
• Access is scoped. Every token carries a fixed set of scopes (like checks:read or menu:read) that were granted to your integration for that venue. If you try to call something outside your scopes, you'll get a 403. Need more access? Reach out to your NX integration contact.

Getting a token is a single request — see POST /oauth/token below for the full request/response shape and error codes. Once you have a token, send it as a standard bearer token:

Authorization: Bearer <access_token>

Not sure if your token is working, or want to double check which venue and scopes it resolved to? Call GET /me — it echoes back exactly what your token is authorized for.