Authentication

Every SMBcrm API and MCP request is authenticated with a bearer token scoped to a single SMBcrm account/location — yours. There are two kinds of token, and both are sent the same way.

Two ways to authenticate

Private Integration Token (PIT)A long-lived token you create in your SMBcrm settings. Best for your own backend, automations, dashboards, and AI agents. Start here for most integrations.

OAuth access tokenFor apps where a user authorizes access to their SMBcrm account. You exchange an authorization code for an access token and refresh it over time.

Sending the token

However you obtain it, the token goes in the Authorization header as a bearer token, alongside the required Version header:

curl https://services.smbcrm.com/contacts/<contact_id> \
  -H "Authorization: Bearer <access_token_or_private_integration_token>" \
  -H "Version: v3"

See Base URL & Headers for the full request shape.

Which should I use?

Use a Private Integration Token when you’re building for your own account — a backend job, an internal dashboard, a script, or an AI agent that acts on your data. It needs no authorization flow.

Use OAuth when you’re building an app that other SMBcrm users authorize to act on their account. Each user grants access explicitly, and you receive a token scoped to their account/location.

Scopes & safety

A token can only do what its scopes allow, so request the minimum you need. And because a token grants access to real account data, treat it like a password.

ScopesThe permission each endpoint requires.

Token SafetyStore, scope, rotate, and protect tokens.