Management API authentication

The Management API lets your backend manage your Makini account: connections, mappings, embed forms, your application's own settings, MCP tenants and more. It authenticates with the OAuth 2.0 client credentials grant, a server-to-server flow with no user in the loop.

Use it when your own backend acts on your account. When your end users connect their systems, use Makini Link instead.

Get your client credentials

Open Settings → Application in the dashboard. Copy the Client ID, and click Generate secret to create a client secret. The secret is shown once, so store it right away.

Keep the client secret on your server. Never put it in browser code, mobile apps or public repositories.

Request a token

Send a form-encoded POST to the token endpoint. Pass your credentials with HTTP Basic authentication, or as client_id and client_secret form fields, but not both.

HTTP Basic

Form fields

The token endpoint accepts only application/x-www-form-urlencoded bodies. The response:

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "connections:read connections:write clients:read clients:write mcp:provider:manage"
}

Field	Description
`access_token`	The bearer token for Management API requests.
`token_type`	Always `Bearer`.
`expires_in`	Seconds until the token expires: one hour.
`scope`	The scopes the token carries.

There is no refresh token. When the token expires, request a new one the same way.

Scopes

Scope	Grants
`connections:read`	Read your connections.
`connections:write`	Create and change your connections.
`clients:read`	Read your application's own registration and its embed forms.
`clients:write`	Generate a client secret, and change your redirect URIs and embed forms.
`mcp:provider:manage`	Manage your customers and their MCP users in provider mode.

A token carries all of your application's scopes by default. To follow least privilege, pass a space-separated scope parameter with only the scopes a service needs:

Make requests

The Management API lives under https://api.makini.io/mgmt. Send the token in the Authorization header:

This lists your connections and needs connections:read.

A Management API token manages your account. To read or write a connection's data on /v4, use that connection's own token. See Authentication.

Errors

The token endpoint answers with the standard OAuth error body, {error, error_description}:

Status	`error`	Cause
`401`	`invalid_client`	The client ID or secret is wrong or missing.
`400`	`unsupported_grant_type`	The `grant_type` isn't one Makini supports.
`400`	`invalid_scope`	The `scope` parameter asks for a scope your application doesn't have.
`400`	`invalid_request`	The body isn't form-encoded, or a parameter is missing or repeated.

An expired or missing token on a Management API request answers 401.

Management API authentication

Get your client credentials#

Request a token#

Scopes#

Make requests#

Errors#

Get your client credentials

Request a token

Scopes

Make requests

Errors