




Have any questions? We’re here to help You
All API requests require authentication via bearer token. After successfully connecting a system through Makini's authentication module, you receive an API token. Include this token in the Authorization header of your requests: `Authorization: Bearer YOUR_API_TOKEN`. Each connection has a unique token, allowing you to manage multiple customer connections independently. Tokens remain valid as long as the underlying system credentials are valid and the connection is active. If a customer changes their system credentials, you'll need to reconnect to obtain a new token.
Design your webhook receiver to handle duplicates and out-of-order webhooks, as network issues or retries can cause both scenarios. Keep the receiver lightweight—ideally writing incoming webhooks to a queue or reliable storage—then process them asynchronously. This prevents timeouts and allows your system to handle high-volume webhook spikes. Respond with a 200 status code immediately after receiving the webhook, before processing begins. Implement idempotency by tracking processed webhook IDs and skipping duplicates. Use constant-time comparison for signature verification to prevent timing attacks. If webhook processing fails, log the error but still return 200 to prevent unnecessary retries. Set up monitoring and alerts for webhook failures so you can investigate issues promptly. For critical workflows, combine webhooks with periodic polling as a fallback mechanism.
Makini uses standard HTTP status codes and structured error responses. Error responses include an error code (e.g., `AUTHENTICATION_FAILED`, `RATE_LIMIT_EXCEEDED`), error type for categorization, a human-readable error message, and a unique request ID for support inquiries. Common status codes include 400 for invalid requests, 401 for authentication failures, 403 for permission issues, 429 for rate limiting, 500 for server errors, and 503 for service unavailability. Use the error code for programmatic error handling rather than parsing error messages. The request ID helps our support team quickly identify and investigate specific issues.
Makini provides webhook testing tools in the dashboard where you can trigger test webhook deliveries to verify your endpoint configuration. Test webhooks use sample payloads matching actual event structures. Verify your endpoint receives the webhook, validates the signature correctly, and responds with a 200 status code within 10 seconds. Test webhook retries by having your endpoint return error codes or timeout, then verify Makini retries as expected. Test duplicate handling by processing the same webhook multiple times. For local development, use tools like ngrok to expose your local endpoint for webhook testing. The webhook logs in the Makini dashboard show delivery attempts, response codes, and timing, helping debug delivery issues.
