Authentication
Interactive CLI use starts with browser-based PKCE authentication and a short-lived account access token. CI and agents should use account-owned machine tokens restricted to explicit projects and scopes.
Machine-token secrets are shown once. Lexique stores token metadata and a hash rather than the original plain secret. Project-scoped API tokens remain supported only for legacy integrations during migration.
Authorization: Bearer lxq_cli_<selector>_<secret>
Authorization: Bearer lxq_mch_<selector>_<secret>Supported endpoints
- GET `/api/projects/{id}/meta` returns project sync metadata and capabilities.
- GET `/api/projects/{id}/translations/pull` returns entries and rendered files.
- POST `/api/projects/{id}/translations/push` updates existing keys or creates missing keys when allowed.
Agent-ready contract
Use the public OpenAPI file at `/openapi.json` to configure agent tools. MCP wrappers should expose narrow tools around the same endpoints, such as `get_project_meta`, `pull_translations`, and `push_translation_updates`.
For agent writes, use a machine token with the smallest scope needed, keep project IDs explicit, and review diffs before committing exported files back to a repository.