



Have any questions? We’re here to help You
Makini is SOC 2 Type 2 compliant and undergoes penetration testing twice annually. We use industry-standard encryption protocols including TLS 1.2+ for data in transit and AES-256 for data at rest. Customer credentials are encrypted using secure key management practices. Our infrastructure follows security best practices including network segmentation, access controls, and regular security audits. For highly regulated industries or customers with strict compliance requirements, we offer self-hosted deployment options that keep all data within your infrastructure. We've successfully met security requirements for enterprises including financial institutions and government contractors.
API tokens must be stored securely and should never be exposed on the client side or in public repositories. Store tokens in secure environment variables or dedicated secrets management systems like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault. Never hardcode tokens in application code or commit them to version control. Implement proper access controls so only authorized services can access stored tokens. For production environments, use separate tokens from development/testing environments. Rotate tokens periodically and immediately revoke tokens if you suspect they've been compromised. Makini tokens provide access to customer data, so treat them with the same security standards you'd apply to database credentials.
Makini's API supports date filtering on most endpoints using query parameters. You can filter by creation date, modification date, or entity-specific date fields like order date or delivery date. Common patterns include `modified_after=2024-01-01` to retrieve records updated since a specific date, or relative timestamps like `modified_after=2024-01-01T00:00:00Z`. For optimal performance, use incremental data retrieval patterns rather than repeatedly fetching all records. The sync status endpoint provides the last sync timestamp, which you can use as the `modified_after` value for your next query. This approach minimizes data transfer and API load while ensuring you capture all changes.
Authentication errors (401 status code) typically occur for a few reasons: the API token is invalid or expired, the underlying system credentials have changed, the system requires reauthorization, or the token lacks necessary permissions. First, verify you're including the token correctly in the Authorization header. Check the connection status in the Makini dashboard—if it shows as requiring reauthorization, the customer needs to reconnect. If credentials were recently changed in the source system, you'll need to reconnect to obtain a new token. For persistent issues, check if the system account has sufficient permissions to perform the requested operation. If the problem continues, contact support with the request ID for investigation.
