Lokalise Authentication: API Keys & OAuth 2.0 (2026)

Authentication overview

Lokalise provides programmatic access to its platform through a RESTful API, enabling developers to integrate localization workflows directly into their applications, build custom tools, and automate tasks. Effective authentication is critical for securing these interactions, ensuring that only authorized users and applications can access and modify localization data. The Lokalise API supports two primary authentication mechanisms: API tokens (also known as personal access tokens) and OAuth 2.0. Each method serves different use cases, balancing ease of use with security and delegation capabilities.

API tokens are generally suited for server-to-server communication, scripts, and development environments where a single principal requires direct access. OAuth 2.0, conversely, is designed for scenarios where third-party applications need to access a user's Lokalise data without handling their credentials directly, providing a standardized and secure delegation framework. Understanding the appropriate use case for each method is fundamental to implementing secure and efficient integrations with the Lokalise platform.

Supported authentication methods

Lokalise offers distinct authentication methods tailored to different integration needs. The choice of method depends on the application's nature, the level of access required, and the security considerations for user data.

API tokens provide a straightforward mechanism for direct access, suitable for internal tools or scripts where a developer has full control over the token's lifecycle and security. OAuth 2.0, on the other hand, is an industry-standard protocol for delegated authorization, enabling applications to obtain limited access to a user's resources without requiring them to share their credentials. This is particularly important for third-party applications, as it enhances security and user trust by allowing users to grant specific permissions without compromising their account details. For a comprehensive understanding of OAuth 2.0 flows, refer to the OAuth 2.0 specification.

Getting your credentials

The process for obtaining credentials varies depending on the chosen authentication method for Lokalise.

API Token (Personal Access Token)

1. Log in to Lokalise: Access your Lokalise account through the web interface.
2. Navigate to Personal Profile: Go to your user settings or personal profile section.
3. Generate New Token: Locate the "API tokens" or "Personal access tokens" section. Here, you can generate a new token.
4. Define Scopes: When creating a token, you will be prompted to define its scopes (permissions). It is a security best practice to grant only the minimum necessary permissions for the token's intended use. For example, if a token is only needed to read projects, do not grant write or delete permissions.
5. Copy Token: Once generated, the token will be displayed. Copy it immediately, as it is typically shown only once and cannot be retrieved later. Store it securely.

For detailed instructions, consult the Lokalise API reference documentation.

OAuth 2.0

Implementing OAuth 2.0 with Lokalise involves registering your application and then guiding users through an authorization flow.

1. Register Your Application:
• Log in to your Lokalise account.
• Navigate to the "Integrations" or "Applications" section in your organization settings.
• Register a new OAuth application. You will typically need to provide an application name, description, and one or more redirect URIs. The redirect URI is where Lokalise will send the user back after they authorize your application, along with an authorization code.
• Upon registration, you will receive a Client ID and a Client Secret. These are your application's credentials and must be kept confidential.
2. Initiate Authorization Flow:
• Direct users to Lokalise's authorization endpoint, including your Client ID, redirect_uri, and requested scopes.
• The user will be prompted to grant your application the requested permissions.
3. Exchange Authorization Code for Access Token:
• If the user approves, Lokalise redirects them back to your specified redirect_uri with an authorization code.
• Your application then exchanges this authorization code for an Access Token and optionally a Refresh Token by making a server-side request to Lokalise's token endpoint, including your Client ID and Client Secret.
4. Use Access Token:
• The Access Token is then used to make authenticated API requests on behalf of the user.
• Access tokens typically have a limited lifespan, and the Refresh Token can be used to obtain new access tokens without requiring the user to re-authorize.

Further details on the OAuth 2.0 flow, including specific endpoints and parameters, are available in the Lokalise API documentation.

Authenticated request example

Once you have obtained an API token or an OAuth 2.0 access token, you can use it to make authenticated requests to the Lokalise API. Both methods typically involve including the token in the Authorization header of your HTTP requests.

Using an API Token

To authenticate with an API token, include it in the X-Api-Token header for most Lokalise API endpoints. Some SDKs might handle this differently, but the underlying HTTP request structure remains similar.

curl -X GET \
  "https://api.lokalise.com/api/v2/projects" \
  -H "X-Api-Token: YOUR_LOKALISE_API_TOKEN" \
  -H "Content-Type: application/json"

This example fetches a list of projects associated with the API token. Replace YOUR_LOKALISE_API_TOKEN with your actual token.

Using an OAuth 2.0 Access Token

For OAuth 2.0, the access token is typically included in the Authorization header using the Bearer scheme.

curl -X GET \
  "https://api.lokalise.com/api/v2/projects" \
  -H "Authorization: Bearer YOUR_OAUTH_ACCESS_TOKEN" \
  -H "Content-Type: application/json"

This request, using an OAuth 2.0 access token, would also retrieve a list of projects, but specifically those accessible to the user who authorized your application. Replace YOUR_OAUTH_ACCESS_TOKEN with the token obtained through the OAuth flow.

Lokalise offers various SDKs (e.g., Python SDK documentation, JavaScript SDK documentation) that abstract away the raw HTTP requests, providing language-specific methods for authentication and API interaction. These SDKs are recommended for most applications to streamline development and ensure adherence to best practices.

Security best practices

Implementing robust security practices for authentication is crucial when integrating with Lokalise, especially given the sensitive nature of localization data. Adhering to these guidelines helps protect your projects and user information.

• Least Privilege Principle: Always grant the minimum necessary permissions (scopes) to API tokens and OAuth applications. If a token only needs to read projects, do not grant write or delete access. Regularly review and adjust permissions as application needs evolve.
• Secure Storage of Credentials:
• API Tokens: Never hardcode API tokens directly into your source code. Store them in environment variables, secure configuration files, or a secrets management service (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault).
• OAuth Client Secret: The OAuth Client Secret must be kept confidential and never exposed in client-side code or publicly accessible repositories. It should only be used in server-side applications.
• Token Rotation and Expiration:
• API Tokens: Consider implementing a rotation policy for API tokens, regenerating them periodically. If a token is compromised, revoke it immediately through the Lokalise dashboard.
• OAuth Access Tokens: OAuth access tokens are typically short-lived. Utilize refresh tokens securely to obtain new access tokens without user re-authentication. Ensure refresh tokens are also stored securely and revoked if compromised.
• Input Validation and Sanitization: Any data sent to the Lokalise API, especially user-generated content, should be thoroughly validated and sanitized to prevent injection attacks and other vulnerabilities.
• HTTPS Everywhere: All communication with the Lokalise API occurs over HTTPS, ensuring data is encrypted in transit. Verify that your applications strictly enforce HTTPS for all API interactions.
• Error Handling: Implement robust error handling to gracefully manage authentication failures, token expiry, or invalid credentials. Avoid exposing sensitive error messages to end-users that could aid an attacker.
• Logging and Monitoring: Implement logging for API access and authentication attempts. Monitor these logs for unusual activity, failed login attempts, or unauthorized access patterns, which could indicate a security incident.
• Rate Limiting: While Lokalise implements its own rate limits, consider adding client-side rate limiting or circuit breakers to your applications to prevent accidental or malicious abuse of the API, and to handle transient service disruptions gracefully.
• Secure Development Practices: Follow general secure coding guidelines and conduct regular security audits and penetration testing of applications that integrate with Lokalise. The OWASP Top Ten provides a foundational list of common web application security risks and mitigation strategies.

By adhering to these security best practices, developers can build secure and reliable integrations with the Lokalise platform, protecting both their applications and their localization data.