This tutorial walks through generating a Noxyr Server API key, calling the six endpoints from Node.js and the browser, and putting live Discord data on a public page. If you've ever wanted a real member counter on your website that updates without a bot connection, this is it.

Step 1 — Generate the key

Open the Noxyr dashboard, pick your server and go to API Access. Click Generate API Key. The key (starts with nxr_) is shown once — copy it into an environment variable now. Only a SHA-256 hash is stored server-side, so a lost key means regeneration.

Step 2 — Set your scopes

Below the key, six toggles gate what the key can read: Server Overview, Tickets, Activity, Invoices, Reviews, Giveaways. Turn off anything you don't need — a disabled scope returns 403 instantly, so a leaked key still can't read scopes you never enabled.

Step 3 — Curl smoke test

curl https://noxyrbot.com/api/v1/server \
  -H "Authorization: Bearer nxr_YOUR_KEY"

You should see JSON with your server's id, name, icon URL, member count, online count and boosts.

Step 4 — Call it from Node.js

const KEY = process.env.NOXYR_API_KEY;

async function getStats() {
    const [server, tickets, activity] = await Promise.all([
        fetch('https://noxyrbot.com/api/v1/server',              { headers: { Authorization: `Bearer ${KEY}` } }),
        fetch('https://noxyrbot.com/api/v1/tickets',             { headers: { Authorization: `Bearer ${KEY}` } }),
        fetch('https://noxyrbot.com/api/v1/activity?days=7',     { headers: { Authorization: `Bearer ${KEY}` } })
    ]);
    return {
        server:   await server.json(),
        tickets:  await tickets.json(),
        activity: await activity.json()
    };
}

getStats().then(console.log);

Step 5 — Call it from the browser

CORS is open, so you can fetch straight from a static site. Do not embed the key in client-side code that ships to real users — anyone opening DevTools would see it. Two safe patterns:

  • Public dashboard behind a proxy: a tiny serverless function on your side reads the key from an env var, calls Noxyr and forwards the JSON to the browser.
  • Trusted internal tool: gate the page behind your own auth, then feed the key in.
// Cloudflare Worker / Vercel Edge — key stays on the server
export default {
    async fetch(request, env) {
        const upstream = await fetch('https://noxyrbot.com/api/v1/server', {
            headers: { Authorization: `Bearer ${env.NOXYR_API_KEY}` }
        });
        return new Response(await upstream.text(), {
            headers: { 'content-type': 'application/json', 'cache-control': 'public, max-age=60' }
        });
    }
};

Step 6 — Render it

<div id="members">…</div>
<script>
    fetch('/api/live-server-stats')
        .then((r) => r.json())
        .then((data) => {
            document.getElementById('members').textContent =
                `${data.memberCount.toLocaleString()} members · ${data.onlineCount} online`;
        });
</script>

Rate limits and caching

60 requests per minute per key. Realtime feels great on a private dashboard but is wasteful on a public site — cache upstream responses for 30–60 seconds in your proxy layer and you'll never come close to the limit.

Error responses

  • 401 unauthorized — missing or bad key.
  • 403 key_disabled — key toggled off on the dashboard.
  • 403 scope_disabled — the endpoint's scope is turned off; fix on the dashboard.
  • 404 guild_unavailable — the bot has been removed from that server.
  • 429 rate_limited — slow down.

Want to know why the API is shaped this way? API design principles for Discord bots.