Use a read token for pipeline pulls
CI jobs that only export bundles should use a token with read-only translation scope. Keep write tokens for controlled update flows.
Pipeline sketch
curl -fsS \
-H "Authorization: Bearer $LEXIQUE_PROJECT_TOKEN" \
"https://lexique.app/api/projects/123/translations/pull?format=yaml&locale[]=en" \
| jq -r '.files[0].content' > translations/messages.en.yaml
Failure handling
- Fail the job on unauthenticated, forbidden, or payment-required API responses.
- Keep generated files deterministic so review diffs are readable.
- Do not log token values or translation content containing secrets.