Skip to main content

Authentication

There are two ways to authenticate a request:

  • API key — Authorization: Basic <base64(secret)>, for server-to-server integrations. Keys are created per project on app.multilocale.com.
  • Access token — Authorization: Token <base64(accessToken)>, the JWT the dashboard and the CLI's browser session use. Obtain it via login or signup below.

API keys​

Authorization: Basic <base64(secret)>

Base64 of the secret alone — not key:secret, and there is no colon, which is where this differs from ordinary HTTP Basic auth:

curl https://api.multilocale.com/api/phrases \
  -H "Authorization: Basic $(printf %s 'the-key-secret' | base64)"

The secret is the only tenant authority: it selects both the organization and the single project the key may touch. A key can never reach another project in its organization, and passing ?organizationId= cannot widen it.

Scopes are projects:read, projects:write, phrases:read, phrases:write and translations:write. New keys default to the read scopes, so widen a key on its page before using it for writes.

The multilocale CLI takes the same secret — multilocale login --with-key, or export MULTILOCALE_API_KEY=<key secret>. See the CLI guide.

Login​

Authenticate with email and password.

POST /api/login

Headers​

Authorization: Basic <base64(email:password)>

Response​

{
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIs..."
}

Example​

curl -X POST https://api.multilocale.com/api/login \
  -H "Authorization: Basic $(echo -n 'user@example.com:password123' | base64)"

Signup​

Create a new account.

POST /api/signup

Headers​

Authorization: Basic <base64(email:password)>

Body (optional)​

{
  "firstName": "John",
  "lastName": "Doe",
  "language": "en"
}

Response​

{
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIs...",
  "newOrganization": true
}

Refresh Token​

Access tokens expire. Use the refresh token to get new tokens without re-authenticating.

POST /api/refresh-access-token

Headers​

Authorization: Token <base64(refreshToken)>

Response​

{
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIs..."
}

Using Tokens​

Include the access token in the Authorization header for authenticated requests:

Authorization: Token <base64(accessToken)>

Example​

curl https://api.multilocale.com/api/projects \
  -H "Authorization: Token $(echo -n 'eyJhbGciOiJIUzI1NiIs...' | base64)"

Forgot Password​

Request a password reset email.

POST /api/forgot-password

Headers​

Authorization: Basic <base64(email)>

Response​

{
  "email": "user@example.com"
}

Change Password​

Change password using a forgot-password token.

POST /api/change-password

Body​

{
  "newPassword": "newSecurePassword123",
  "forgotPasswordToken": "token-from-email"
}

Response​

{}