Multilocale

Multilocale API Authentication#

There are two ways to authenticate a request:

  • API key — Authorization: Basic <base64(secret)>, for server-to-server integrations. Keys are created per project on app.multilocale.com.
  • Access token — Authorization: Token <base64(accessToken)>, the JWT the dashboard and the CLI's browser session use. Obtain it via login or signup below.

API keys#

Authorization: Basic <base64(secret)>

Base64 of the secret alone — not key:secret, and there is no colon, which is where this differs from ordinary HTTP Basic auth:

curl https://api.multilocale.com/api/phrases \
  -H "Authorization: Basic $(printf %s 'the-key-secret' | base64)"

The secret is the only tenant authority: it selects both the organization and the single project the key may touch. A key can never reach another project in its organization, and passing ?organizationId= cannot widen it.

Scopes are projects:read, projects:write, phrases:read, phrases:write and translations:write. New keys default to the read scopes, so widen a key on its page before using it for writes.

The multilocale CLI takes the same secret — multilocale login --with-key, or export MULTILOCALE_API_KEY=<key secret>. See the CLI guide.

Login#

Authenticate with email and password.

POST /api/login

Headers#

Authorization: Basic <base64(email:password)>

Response#

{
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIs..."
}

Example#

curl -X POST https://api.multilocale.com/api/login \
  -H "Authorization: Basic $(echo -n 'user@example.com:password123' | base64)"

Signup#

Create a new account.

POST /api/signup

Headers#

Authorization: Basic <base64(email:password)>

Body (optional)#

{
  "firstName": "John",
  "lastName": "Doe",
  "language": "en"
}

Response#

{
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIs...",
  "newOrganization": true
}

Refresh Token#

Access tokens expire. Use the refresh token to get new tokens without re-authenticating.

POST /api/refresh-access-token

Headers#

Authorization: Token <base64(refreshToken)>

Response#

{
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIs..."
}

Using Tokens#

Include the access token in the Authorization header for authenticated requests:

Authorization: Token <base64(accessToken)>

Example#

curl https://api.multilocale.com/api/projects \
  -H "Authorization: Token $(echo -n 'eyJhbGciOiJIUzI1NiIs...' | base64)"

Forgot Password#

Request a password reset email.

POST /api/forgot-password

Headers#

Authorization: Basic <base64(email)>

Response#

{
  "email": "user@example.com"
}

Change Password#

Change password using a forgot-password token.

POST /api/change-password

Body#

{
  "newPassword": "newSecurePassword123",
  "forgotPasswordToken": "token-from-email"
}

Response#

{}