




Have any questions? We’re here to help You
API tokens must be stored securely and should never be exposed on the client side or in public repositories. Store tokens in secure environment variables or dedicated secrets management systems like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault. Never hardcode tokens in application code or commit them to version control. Implement proper access controls so only authorized services can access stored tokens. For production environments, use separate tokens from development/testing environments. Rotate tokens periodically and immediately revoke tokens if you suspect they've been compromised. Makini tokens provide access to customer data, so treat them with the same security standards you'd apply to database credentials.
Webhooks allow Makini to notify your application of events in real-time. To set up webhooks, configure a webhook URL in your connection settings or during the initial connection flow. Your webhook endpoint must accept POST requests, respond within 10 seconds with a 200 status code, and use HTTPS with a valid SSL certificate. Makini will send webhook payloads to your endpoint when configured events occur, such as sync completion, connection status changes, or errors requiring attention. We recommend keeping your webhook receiver lightweight—ideally just writing the payload to a queue for asynchronous processing—to avoid timeouts and ensure reliable delivery.
Makini uses standard HTTP status codes and structured error responses. Error responses include an error code (e.g., `AUTHENTICATION_FAILED`, `RATE_LIMIT_EXCEEDED`), error type for categorization, a human-readable error message, and a unique request ID for support inquiries. Common status codes include 400 for invalid requests, 401 for authentication failures, 403 for permission issues, 429 for rate limiting, 500 for server errors, and 503 for service unavailability. Use the error code for programmatic error handling rather than parsing error messages. The request ID helps our support team quickly identify and investigate specific issues.
Makini supports create, read, update, and delete (CRUD) operations, though availability varies by system and entity type. Most systems support creating and updating core entities like purchase orders, work orders, and inventory items. Read operations are universally supported across all entity types. Delete operations are less commonly supported due to system constraints—many industrial systems use soft deletes or status changes rather than true deletion. Update operations may be limited to specific fields depending on system configuration and business rules. For example, some systems prevent modifying purchase orders after approval. We recommend validating specific operation support for your use case during the technical deep dive.
