




Have any questions? We’re here to help You
API tokens must be stored securely and should never be exposed on the client side or in public repositories. Store tokens in secure environment variables or dedicated secrets management systems like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault. Never hardcode tokens in application code or commit them to version control. Implement proper access controls so only authorized services can access stored tokens. For production environments, use separate tokens from development/testing environments. Rotate tokens periodically and immediately revoke tokens if you suspect they've been compromised. Makini tokens provide access to customer data, so treat them with the same security standards you'd apply to database credentials.
Design your webhook receiver to handle duplicates and out-of-order webhooks, as network issues or retries can cause both scenarios. Keep the receiver lightweight—ideally writing incoming webhooks to a queue or reliable storage—then process them asynchronously. This prevents timeouts and allows your system to handle high-volume webhook spikes. Respond with a 200 status code immediately after receiving the webhook, before processing begins. Implement idempotency by tracking processed webhook IDs and skipping duplicates. Use constant-time comparison for signature verification to prevent timing attacks. If webhook processing fails, log the error but still return 200 to prevent unnecessary retries. Set up monitoring and alerts for webhook failures so you can investigate issues promptly. For critical workflows, combine webhooks with periodic polling as a fallback mechanism.
Customers connect systems through Makini's authentication module, which provides a simple, guided connection flow. The process typically takes 2-5 minutes: Select the system from our list of 2,000+ products. Enter connection details (usually just the instance URL and credentials). Authorize the connection. Makini validates credentials and establishes the connection. The connection flow is designed for non-technical users and can be embedded directly in your application, allowing customers to connect without leaving your product. For systems requiring additional setup (like API token generation), we provide step-by-step guidance within the connection flow. Customers see real-time feedback during connection, and if any issues occur, clear error messages guide them to resolution.
Makini provides several performance monitoring capabilities. API responses include timing information showing request processing time. The dashboard includes performance metrics showing average response times, throughput, and error rates over time. You can set up alerts for performance degradation or error rate increases. Each request generates a unique request ID that enables detailed performance analysis. For workflow-based integrations, execution logs show per-step timing, helping identify bottlenecks. We recommend implementing client-side monitoring to track end-to-end latency including network time. Monitor trends over time rather than individual requests—occasional slow requests are normal, but sustained increases may indicate issues requiring investigation.
