BUILD WITH BEXO / START HERE

Your first BEXO integration

Start with connectivity and credential boundaries, then add verification and recovery. Keep test traffic separate from real member activity.

Reference edition 2026-10-19 • Selected public contract

quickstartsetupNFCERP

Before you start

A BEXO integration contact or an approved workspace with an agreed deployment environment.
A backend or managed reader that can keep a secret out of browser and mobile bundles.
A registered terminal and scoped integration key for that environment. Live key creation is not a self-service API in this reference.
A controlled test membership and card for your isolated environment. Do not invent payment proof or seed example identities into production.

Configure your API origin

Environment	API base	Purpose
Production	https://dash.mybexo.com/api	Only approved, configured production traffic.
Local isolated development	http://localhost:5001/api	Your local API connected to an isolated test environment.

shell

export BEXO_API_BASE="http://localhost:5001/api"
# Load BEXO_INTEGRATION_KEY securely from your secret store.
# Set BEXO_TERMINAL_SERIAL to a reader registered in that environment.

The API base already contains /api. Append /pos/v1/ping, not /api/pos/v1/ping a second time. Production requests use HTTPS.

Check the registered reader

shell

curl --fail-with-body "$BEXO_API_BASE/pos/v1/ping" \
  -H "Authorization: Bearer $BEXO_INTEGRATION_KEY" \
  -H "X-Terminal-Serial: $BEXO_TERMINAL_SERIAL"

Expect status=online, the vendor and terminal references, and serverTime. A 401 is a credential/reader association problem; a 403 can mean a missing scope, inactive vendor or revoked reader. Keep X-Request-Id for support. Ping updates connectivity telemetry.

Evaluate a controlled card read

shell

curl --fail-with-body "$BEXO_API_BASE/pos/v1/verify" \
  -H "Authorization: Bearer $BEXO_INTEGRATION_KEY" \
  -H "X-Terminal-Serial: $BEXO_TERMINAL_SERIAL" \
  -H "Content-Type: application/json" \
  --data '{"cardUid":"<CONTROLLED_TEST_CARD_UID>"}'

The reader supplies the card identifier. A request can return HTTP 200 with verified=false and decision=deny; this is a completed access decision. Do not open access because the HTTP request succeeded. Do not equate a network timeout with permission.

Review verification response fields and test active, expired, missing and revoked conditions.

Prepare for operation

Keep credentials server-side or on a managed reader. Separate owner sessions from integration keys.
Render an allowed or denied outcome clearly; show a recovery state if a request cannot complete.
Minimize member data displayed and retained. Use the member’s current disclosure choices.
Plan credential revocation, telemetry, failure alerts and a support path with request IDs.
Complete the integration checklist with your BEXO contact before going live.

Continue with the release checklist.