




Have any questions? We’re here to help You
API tokens must be stored securely and should never be exposed on the client side or in public repositories. Store tokens in secure environment variables or dedicated secrets management systems like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault. Never hardcode tokens in application code or commit them to version control. Implement proper access controls so only authorized services can access stored tokens. For production environments, use separate tokens from development/testing environments. Rotate tokens periodically and immediately revoke tokens if you suspect they've been compromised. Makini tokens provide access to customer data, so treat them with the same security standards you'd apply to database credentials.
The initial sync occurs when you first connect a system and retrieves historical data to establish a baseline. This includes records from a configurable time period (typically 30-90 days) and can take several minutes to hours depending on data volume. Initial syncs are complete snapshots of the requested data. Incremental syncs occur on subsequent runs and retrieve only records created or modified since the last successful sync. Makini tracks sync timestamps and uses them to query for changes efficiently. Incremental syncs are much faster, usually completing in seconds to minutes. This approach minimizes API load on source systems while keeping your data current.
Design your webhook receiver to handle duplicates and out-of-order webhooks, as network issues or retries can cause both scenarios. Keep the receiver lightweight—ideally writing incoming webhooks to a queue or reliable storage—then process them asynchronously. This prevents timeouts and allows your system to handle high-volume webhook spikes. Respond with a 200 status code immediately after receiving the webhook, before processing begins. Implement idempotency by tracking processed webhook IDs and skipping duplicates. Use constant-time comparison for signature verification to prevent timing attacks. If webhook processing fails, log the error but still return 200 to prevent unnecessary retries. Set up monitoring and alerts for webhook failures so you can investigate issues promptly. For critical workflows, combine webhooks with periodic polling as a fallback mechanism.
Authentication errors (401 status code) typically occur for a few reasons: the API token is invalid or expired, the underlying system credentials have changed, the system requires reauthorization, or the token lacks necessary permissions. First, verify you're including the token correctly in the Authorization header. Check the connection status in the Makini dashboard—if it shows as requiring reauthorization, the customer needs to reconnect. If credentials were recently changed in the source system, you'll need to reconnect to obtain a new token. For persistent issues, check if the system account has sufficient permissions to perform the requested operation. If the problem continues, contact support with the request ID for investigation.
