Help docs

API & webhooks

Automate maps and locations through a versioned REST API. API access and webhooks are available on Pro and Business.

Authentication

Create a scoped key from Developer settings. Send it as a bearer token. The complete key is displayed only once.

curl "https://your-domain.com/api/v1/maps?limit=50&offset=0" \
  -H "Authorization: Bearer mm_live_..."

Endpoints

GET/api/v1/mapsList maps
POST/api/v1/mapsCreate a map
GET/api/v1/maps/{mapId}Retrieve a map
PATCH/api/v1/maps/{mapId}Update a map
DELETE/api/v1/maps/{mapId}Delete a map
GET/api/v1/maps/{mapId}/markersList locations
POST/api/v1/maps/{mapId}/markersCreate a location
PATCH/api/v1/maps/{mapId}/markers/{markerId}Update a location
DELETE/api/v1/maps/{mapId}/markers/{markerId}Delete a location

List responses include limit, offset, and total. Errors use a stable {"error":{"code":"…","message":"…"}} envelope.

Create a location

curl -X POST "https://your-domain.com/api/v1/maps/{mapId}/markers" \
  -H "Authorization: Bearer mm_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "title": "North office",
    "lat": 40.741,
    "lng": -73.989,
    "tags": ["office"]
  }'

Verify webhook signatures

Compute HMAC-SHA256 over the timestamp, a period, and the exact raw request body. Compare it with the hexadecimal value in X-MapsMaker-Signature. Reject stale timestamps.

const signed = timestamp + "." + rawBody;
const expected = "v1=" + createHmac("sha256", signingSecret)
  .update(signed)
  .digest("hex");
const supplied = Buffer.from(signature);
const trusted = Buffer.from(expected);

if (supplied.length !== trusted.length || !timingSafeEqual(supplied, trusted)) {
  throw new Error("Invalid signature");
}