Quick Start

This guide gets you to a working, authenticated request against your own SMBcrm account/location: a token, a base URL, and one API call. It takes about five minutes.

Step 1: Get a token

The fastest path is a Private Integration Token (PIT), created from your SMBcrm account’s settings. Choose only the scopes you need. For this guide, a read-only scope like contacts.readonly is enough.

See Private Integration Tokens for where to generate one and how to store it. If Private Integrations isn’t listed under Settings, turn the feature on under Labs and reload the page.

Note

Building something that other people will authorize against their own SMBcrm account/location, rather than yours? Use OAuth instead. A PIT is tied to the account that created it, which makes it the faster option for scripts, internal tools, and integrations you run yourself.

Step 2: Set the base URL and headers

Every request goes to the same base URL and needs the same two headers:

https://services.smbcrm.com

Header	Value
Authorization	Bearer <token>
Version	v3

Add Content-Type: application/json on requests that send a JSON body. The exceptions are the OAuth token endpoint (application/x-www-form-urlencoded) and file uploads (multipart/form-data, which your HTTP client sets for you). See Base URL & Headers for versioning, pagination, and rate-limit details.

Step 3: Make a call

Searching contacts is a good first call: it only needs your token and your account/location ID, and it doesn’t change any data.

POST/contacts/search

Search contacts in your account/location.

scope contacts.readonlyauth Location token or PIT

cURL

curl -X POST https://services.smbcrm.com/contacts/search \
  -H "Authorization: Bearer <token>" \
  -H "Version: v3" \
  -H "Content-Type: application/json" \
  -d '{
    "locationId": "<location_id>",
    "pageLimit": 5
  }'

Node.js

const res = await fetch('https://services.smbcrm.com/contacts/search', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${token}`,
    Version: 'v3',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    locationId: '<location_id>',
    pageLimit: 5,
  }),
});

const data = await res.json();
console.log(data);

200 OK

{
  "contacts": [
    { "id": "<contact_id>", "firstName": "Jordan", "email": "[email protected]" }
  ],
  "total": 1
}

If you get a contacts array back, even an empty one, your token, headers, and base URL are all correct.

Tip

Make calls like this from your server, not the browser. Tokens must stay secret and should never ship in client-side JavaScript. See Token Safety for how to store and handle them.

Step 4: Next steps

Contacts APICreate, search, tag, and manage the people in your account.

MCP ServerConnect an AI agent to your account using the same token.

WebhooksGet notified of changes in real time instead of polling.