



Have any questions? We’re here to help You
All API requests require authentication via bearer token. After successfully connecting a system through Makini's authentication module, you receive an API token. Include this token in the Authorization header of your requests: `Authorization: Bearer YOUR_API_TOKEN`. Each connection has a unique token, allowing you to manage multiple customer connections independently. Tokens remain valid as long as the underlying system credentials are valid and the connection is active. If a customer changes their system credentials, you'll need to reconnect to obtain a new token.
API tokens must be stored securely and should never be exposed on the client side or in public repositories. Store tokens in secure environment variables or dedicated secrets management systems like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault. Never hardcode tokens in application code or commit them to version control. Implement proper access controls so only authorized services can access stored tokens. For production environments, use separate tokens from development/testing environments. Rotate tokens periodically and immediately revoke tokens if you suspect they've been compromised. Makini tokens provide access to customer data, so treat them with the same security standards you'd apply to database credentials.
Authentication errors (401 status code) typically occur for a few reasons: the API token is invalid or expired, the underlying system credentials have changed, the system requires reauthorization, or the token lacks necessary permissions. First, verify you're including the token correctly in the Authorization header. Check the connection status in the Makini dashboard—if it shows as requiring reauthorization, the customer needs to reconnect. If credentials were recently changed in the source system, you'll need to reconnect to obtain a new token. For persistent issues, check if the system account has sufficient permissions to perform the requested operation. If the problem continues, contact support with the request ID for investigation.
Makini takes a defense-in-depth approach to security. All data in transit uses TLS 1.2 or higher. Data at rest is encrypted using AES-256 encryption. Customer credentials are encrypted using secure key management with separate encryption keys per customer. We implement network segmentation, strict access controls, and follow the principle of least privilege. Our infrastructure undergoes regular security audits, penetration testing, and vulnerability assessments. We're SOC 2 Type 2 certified, demonstrating our commitment to security controls. Employee access to production systems is logged and monitored. For customers with strict compliance requirements, we offer self-hosted deployments where data never leaves your infrastructure, eliminating Makini as a data processor.
