Quick Start

This guide takes you from zero to a working, authenticated request against your own SMBcrm account/location: a token, a base URL, and one API call. It takes about five minutes.

Step 1: Get a token

The fastest path is a Private Integration Token (PIT), created from your SMBcrm account’s settings. Choose only the scopes you need. For this guide, a read-only scope like contacts.readonly is enough.

See Private Integration Tokens for exactly where to generate one and how to store it.

Note

Building something that other people will authorize against their own SMBcrm account/location, rather than yours? Use OAuth instead. A PIT is tied to the account that created it, which makes it the faster option for scripts, internal tools, and integrations you run yourself.

Step 2: Set the base URL and headers

Every request goes to the same base URL and needs the same two headers:

https://services.smbcrm.com

Header	Value
Authorization	Bearer <token>
Version	v3

Add Content-Type: application/json on any request that sends a body. That’s the whole contract. See Base URL & Headers for versioning, pagination, and rate-limit details.

Step 3: Make a call

Searching contacts is a good first call: it only needs your token and your account/location ID, and it doesn’t change any data.

POST/contacts/search

Search contacts in your account/location.

scope contacts.readonlyauth Location token or PIT

cURL

curl -X POST https://services.smbcrm.com/contacts/search \
  -H "Authorization: Bearer <token>" \
  -H "Version: v3" \
  -H "Content-Type: application/json" \
  -d '{
    "locationId": "<location_id>",
    "pageLimit": 5
  }'

Node.js

const res = await fetch('https://services.smbcrm.com/contacts/search', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${token}`,
    Version: 'v3',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    locationId: '<location_id>',
    pageLimit: 5,
  }),
});

const data = await res.json();
console.log(data);

200 OK

{
  "contacts": [
    { "id": "<contact_id>", "firstName": "Jordan", "email": "[email protected]" }
  ],
  "total": 1
}

A contacts array back, even an empty one, means your token, headers, and base URL are all correct.

Tip

Make calls like this from your server, not the browser. Tokens must stay secret and should never ship in client-side JavaScript. See Token Safety for how to store and handle them.

Step 4: Next steps

Contacts APICreate, search, tag, and manage the people in your account.

MCP ServerConnect an AI agent to your account using the same token.

WebhooksGet notified of changes in real time instead of polling.