DeepL Authentication: API Key Setup & Security (2026)

Authentication overview

DeepL's API provides machine translation services that require authentication to ensure secure access and proper billing. All requests to the DeepL API must include a valid authentication key (AuthKey) associated with a DeepL Pro account. This key serves as a credential to identify the client making the request and authorize their access to the translation functionalities. The authentication process is designed to be straightforward, allowing developers to integrate translation capabilities into their applications with minimal overhead while maintaining security standards. All communication with the DeepL API is encrypted using Transport Layer Security (TLS) 1.2 or higher to protect data in transit, aligning with industry best practices for secure web communication, as detailed by the IETF's TLS 1.3 specification.

DeepL supports two main API versions, v1 and v2, both of which utilize the same API key authentication mechanism. While the endpoints and specific parameters may differ between versions, the method for authenticating requests remains consistent. Developers are encouraged to use the latest API version (v2) for new integrations due to potential enhancements and ongoing support. The official DeepL documentation provides comprehensive API reference details for both versions.

Supported authentication methods

DeepL primarily uses API key authentication. This method involves generating a unique secret key from your DeepL account, which is then included in every API request. The API key acts as a bearer token or a credential within the request, allowing the DeepL servers to verify the sender's identity and permissions.

The API key can be transmitted in one of two ways, depending on the specific API endpoint or SDK implementation:

1. HTTP Header: The recommended and most common method is to include the API key in the Authorization HTTP header as a Bearer token. This approach is widely considered a secure practice for transmitting API keys, as headers are typically processed before the request body and are less likely to be logged in certain server configurations, although this is not a guarantee of security.
2. Request Body: For some endpoints or specific client libraries, the API key might be included directly in the request body as a parameter (e.g., auth_key). While functional, this method is generally less preferred than using the HTTP header for sensitive information like API keys, as it can be more susceptible to logging in web server access logs.

The following table summarizes DeepL's authentication method:

Getting your credentials

To obtain your DeepL API key, you must have a DeepL Pro account with an active API plan. The process involves registering for an account and then navigating to your account settings to generate the key. Here are the general steps:

1. Sign up for DeepL Pro: If you don't already have one, create a DeepL Pro account. You can choose from various plans, including the DeepL API Free plan, which offers a limited number of characters per month for testing and light usage.
2. Access your Account: Log in to your DeepL Pro account on the DeepL website.
3. Navigate to Account Settings: Look for a section related to 'Account', 'API Access', or 'Developers' in your profile or settings dashboard. The exact navigation may vary slightly but is typically intuitive.
4. Generate API Key: Within the API access section, you will find an option to generate or view your API key. If you are generating a new key, ensure you copy it immediately, as it may only be displayed once for security reasons. If you lose your key, you may need to generate a new one, invalidating the previous one.
5. Store Securely: Once generated, store your API key securely. Avoid hardcoding it directly into your application's source code. Consider using environment variables, a secrets management service, or configuration files that are not committed to version control.

For detailed, step-by-step instructions and visual guides, refer to the official DeepL documentation.

Authenticated request example

This example demonstrates how to make an authenticated request to the DeepL API using a Python SDK. The DeepL API supports various official SDKs, including Python, Java, C#, PHP, Node.js, Go, and Ruby, all of which simplify the authentication process.

Python SDK Example

First, install the DeepL Python library:

pip install deepl

Then, use the library to translate text, providing your API key:

import deepl
import os

# It's recommended to store your API key in an environment variable
auth_key = os.getenv("DEEPL_AUTH_KEY") # Replace with your actual key or environment variable

if not auth_key:
    raise ValueError("DEEPL_AUTH_KEY environment variable not set.")

# Initialize the Translator with your AuthKey
translator = deepl.Translator(auth_key)

# Translate text
try:
    result = translator.translate_text("Hello, world!", target_lang="FR")
    print(f"Translated text: {result.text}")
except deepl.DeepLError as e:
    print(f"DeepL API Error: {e}")
    # Handle specific errors like authentication failure, usage limits, etc.

cURL Example (API v2)

For direct HTTP requests, you can use curl, including the API key in the Authorization header:

curl -X POST 'https://api-free.deepl.com/v2/translate' \
     -H 'Authorization: Bearer YOUR_DEEPL_AUTH_KEY' \
     -H 'Content-Type: application/json' \
     -d '{ "text": ["This is a test."], "target_lang": "DE" }'

Replace YOUR_DEEPL_AUTH_KEY with your actual DeepL API key. Note that for the free API plan, the endpoint is api-free.deepl.com, while for paid plans, it is api.deepl.com.

Security best practices

Properly securing your DeepL API key is crucial to prevent unauthorized access to your account and potential misuse of your translation credits. Adhering to these best practices will help maintain the integrity and security of your integrations:

• Do Not Hardcode API Keys: Never embed your API key directly into your application's source code. Hardcoding makes the key discoverable if the code repository is compromised or publicly exposed.
• Use Environment Variables or Secret Management: Store API keys in environment variables, configuration files that are excluded from version control (e.g., .env files), or dedicated secret management services (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault). This separates sensitive credentials from your codebase.
• Restrict Key Access: Limit who has access to your API keys within your organization. Implement role-based access control (RBAC) to ensure only authorized personnel can retrieve or manage keys.
• Use TLS/SSL: All communication with the DeepL API occurs over HTTPS, ensuring that your API key and translated data are encrypted in transit. Always verify that your client applications are enforcing TLS 1.2 or higher.
• Rotate API Keys Regularly: Periodically generate new API keys and revoke old ones. This practice reduces the window of opportunity for a compromised key to be exploited. Many security frameworks, such as those recommended by Google Cloud security best practices, suggest regular key rotation.
• Monitor API Usage: Regularly review your DeepL API usage statistics in your account dashboard. Unusual spikes in usage could indicate a compromised key or unauthorized activity.
• Implement Least Privilege: While DeepL API keys typically grant broad access to translation services, if DeepL were to introduce more granular permissions in the future, adhere to the principle of least privilege, granting only the necessary permissions to each key.
• Client-Side vs. Server-Side: Avoid exposing your API key in client-side code (e.g., JavaScript in a web browser or mobile app directly calling the API). Instead, route client-side requests through a secure backend server that can make the authenticated call to DeepL. This prevents the key from being extracted by malicious users.
• Error Handling: Implement robust error handling in your application to gracefully manage authentication failures. Avoid leaking sensitive information in error messages.