Tolgee exposure depends on which kind of API key is in use
Tolgee exposure depends on which kind of API key is in use Tolgee is a translation management platform with projects, members, branches, integrations, and several API credential types. An exposed instance can contain product strings, unreleased content, and integration secrets. The security review needs to distinguish a project key from a personal access token. On 9 November 2026 at 08:50…
Tolgee is a translation management platform that uses various API credential types, with exposure depending on the type of API key in use. There are two main types of API keys: project keys and personal access tokens (PATs). Project keys are scoped to a single project and can carry selected scopes, while PATs grant access across resources the user can access, except for sensitive endpoints that manage tokens.
A leaked project key may only permit translation reads and writes for that project, while a leaked PAT may reach every project the user can access. Branching in Tolgee does not isolate project keys, so a key that can edit translations may reach a protected or unreleased branch if the project's permissions and branch policy do not prevent it.
To mitigate the risk of exposure, it is recommended to use one credential per integration, label them with an owner, and employ stronger authentication for sensitive actions. Additionally, review who can generate PATs and ensure mandatory multi-factor authentication (MFA) for those accounts. Regularly test token regeneration and expiry to ensure old keys are invalidated.
Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
