Authentication and scopes
Authenticate AI Glot API requests with workspace keys or OAuth tokens, choose minimum scopes and rotate credentials without exposing secrets.
Send a workspace API key or OAuth access token as a bearer credential:
Authorization: Bearer aig_live_••••••••Never place a credential in a query string. URLs are copied into logs, browser history and referrer headers.
Workspace API keys
An admin creates keys in Settings → API. The complete secret is shown once; AI Glot stores only a protected hash. Up to 10 keys may be active in a workspace.
Use a separate named key for each integration. Rotate by creating the replacement, updating the integration, confirming the old key is quiet, then revoking it.
OAuth tokens
The CLI and compatible MCP clients can use OAuth 2.1. OAuth is recommended for a person because the connection records who approved it and respects that member’s access ceiling. API keys remain the right fit for CI and backend services.
Launch scopes
| Scope | Allows |
|---|---|
account:read | Workspace identity, plan, capabilities, limits and credit summary |
usage:read | Usage totals and time buckets |
batches:read | List translations, inspect progress and download completed results |
batches:write | Rename, archive or restore translations |
glossaries:read | List and retrieve glossaries |
glossaries:write | Create, update, replace or delete glossaries |
A missing scope returns 403 insufficient_scope. Future scope names may already exist internally, but they do not imply that upload, batch creation or webhooks are available in v1.
Member ceiling
Workspace admins can limit developer access for members. An OAuth client receives the intersection of what it requested and what the approving member may use. Reconnecting with a broader request cannot bypass a read-only ceiling.