




Have any questions? We’re here to help You
API tokens must be stored securely and should never be exposed on the client side or in public repositories. Store tokens in secure environment variables or dedicated secrets management systems like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault. Never hardcode tokens in application code or commit them to version control. Implement proper access controls so only authorized services can access stored tokens. For production environments, use separate tokens from development/testing environments. Rotate tokens periodically and immediately revoke tokens if you suspect they've been compromised. Makini tokens provide access to customer data, so treat them with the same security standards you'd apply to database credentials.
Testing should cover authentication, data retrieval, data writing, error handling, and workflow logic. Start by connecting a test system through Makini's authentication flow. Use sandbox or non-production instances of your target systems when available. Test API calls for each entity type you'll use (purchase orders, work orders, etc.) to verify data mapping and field coverage. Test error scenarios by providing invalid inputs or attempting operations without proper permissions. For workflow-based integrations, test each workflow step independently before testing end-to-end. Verify webhook delivery and signature verification. Test with realistic data volumes to identify performance issues. Include tests for connection failure scenarios and verify your error handling and retry logic work correctly.
Makini provides sandbox connections for testing without affecting production systems. Sandbox connections include sample data representing common scenarios: standard purchase orders, orders with custom fields, orders in various states (draft, approved, completed), and error cases like invalid vendors or out-of-stock items. Sandbox data is read-only for safety—write operations return success responses without modifying data. This allows thorough testing of your integration logic without risk. For testing with specific systems, we recommend using dedicated test instances of the actual systems (like SAP sandbox environments) connected through Makini, which provides the most realistic testing experience.
Write operation limitations vary by system. Common limitations include: field-level restrictions (some fields may be read-only), business rule validation (orders may require certain fields or valid vendor codes), permission requirements (the connected account needs specific permissions), timing restrictions (some systems prevent modifications after certain workflow states), and rate limits on write operations. Custom fields in target systems may not be writable through standard APIs. Some systems have transactional requirements—for example, purchase order line items must be created in the same transaction as the order header. During implementation, we identify write operation limitations for your specific use cases and design workflows that work within those constraints.
