{
  "id": 19062950,
  "title": "Tolgee exposure depends on which kind of API key is in use",
  "url": "https://urgent.news/2026/11/09/tolgee-exposure-depends-on-which-kind-of-api-key-is-in-use",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-09T01:44:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/bianliang/tolgee-exposure-depends-on-which-kind-of-api-key-is-in-use-61h"
  },
  "original_language": "en",
  "account": null,
  "summary": "Tolgee is a translation management platform that uses various API credential types, with exposure depending on the type of API key in use. There are two main types of API keys: project keys and personal access tokens (PATs). Project keys are scoped to a single project and can carry selected scopes, while PATs grant access across resources the user can access, except for sensitive endpoints that manage tokens. A leaked project key may only permit translation reads and writes for that project, while a leaked PAT may reach every project the user can access. Branching in Tolgee does not isolate project keys, so a key that can edit translations may reach a protected or unreleased branch if the project's permissions and branch policy do not prevent it. To mitigate the risk of exposure, it is recommended to use one credential per integration, label them with an owner, and employ stronger authentication for sensitive actions. Additionally, review who can generate PATs and ensure mandatory multi-factor authentication (MFA) for those accounts. Regularly test token regeneration and expiry to ensure old keys are invalidated.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}