Managing your application

Your application's own settings are on the Management API too: your backend can rotate its client secret and keep its redirect URIs current, with no trip to the dashboard.

Before you start

All routes are under https://api.makini.io/mgmt. Call them with a client_credentials token, as described in Management API authentication:

Scope	Allows
`clients:read`	Reading your application
`clients:write`	Generating a secret and changing redirect URIs

The examples below keep the token in $TOKEN and your client ID in $CLIENT_ID. A token works on its own application only.

Read your application

The answer lists your redirect URIs with their ids, and your secrets by id and expiry. Secret values are never returned here.

Rotate your client secret

Generate a new secret:

{
  "id": "c5cf3d6f-2c7c-4003-b5a8-4c784fb1cc82",
  "secret": "YOUR_NEW_CLIENT_SECRET",
  "expiresAt": "2027-01-08T10:30:00.000Z",
  "revokedAt": null,
  "createdAt": "2026-10-10T10:30:00.000Z"
}

The secret is shown once, so store it right away. Leave out expiresInDays for a secret with no expiry.

Your existing secrets keep working, which makes a rotation safe to run in production:

Generate

Create the new secret and store it in your secret manager.

Switch

Deploy your services with the new secret. Tokens issued with the old one stay valid until they expire.

Retire

Revoke the old secret under Settings → Application in the dashboard.

Redirect URIs

Makini Link sends your customer back to one of your application's redirect URIs after they connect. Add one:

{
  "redirectUri": {
    "id": "c4124233-d766-429d-b3ab-8f805fc23810",
    "uri": "https://app.example.com/makini/callback",
    "createdAt": "2026-10-10T10:30:00.000Z",
    "updatedAt": "2026-10-10T10:30:00.000Z"
  }
}

A redirect URI is https (or http for a loopback address during development) and has no fragment. On https, * may stand for a whole leading host label or a whole path segment, such as https://*.example.com/makini/callback.

Route	Does
`POST /clients/{clientId}/redirect-uris`	Adds a redirect URI.
`PUT /clients/{clientId}/redirect-uris/{uriId}`	Replaces its value.
`DELETE /clients/{clientId}/redirect-uris/{uriId}`	Removes it. Answers `204`.

Get a token: see Management API authentication.

Send customers through Makini Link: see Launching Makini Link.

Managing your application

Before you start#

Read your application#

Rotate your client secret#

Redirect URIs#

Related#

Before you start

Read your application

Rotate your client secret

Redirect URIs

Related