Authentication

Users can generate new API Tokens in the User Profile/Access Tokens tab in Phrase Platform Settings page. Supported applications are:

Phrase Connectors API
Phrase Language AI
Phrase Strings
Phrase Studio
Phrase TMS
Quality Evaluator API
Phrase Style Guides
Phrase Content Groups

Exchanging API tokens for JWT

Exchange the generated API Token for Access Token using Phrase Platform OAuth Token endpoint with urn:ietf:params:oauth:grant-type:token-exchange grant type. This is extension of OAuth basic grants which is specified in OAuth 2.0 Token Exchange (RFC-8693). Supported parameters are:

Parameter name	Value	Required
`grant_type`	`urn:ietf:params:oauth:grant-type:token-exchange`	yes
`subject_token`	API-TOKEN	yes
`subject_token_type`	`urn:phrase:params:oauth:token-type:api_token`	no
`requested_token_type`	`urn:ietf:params:oauth:token-type:access_token`	no

Other fields from the Specification are not supported at the moment. Main endpoint URLs:

https://eu.phrase.com/idm/oauth/token (EU datacenter)
https://us.phrase.com/idm/oauth/token (US datacenter)

Sample request

POST https://eu.phrase.com/idm/oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=API-TOKEN

With curl:

# EU region
curl -X POST https://eu.phrase.com/idm/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \
  -d 'subject_token=API-TOKEN'

# US region
curl -X POST https://us.phrase.com/idm/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \
  -d 'subject_token=API-TOKEN'

The response is in JSON format:

{
  "access_token": "GENERATED-JWT",
  "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "token_type": "Bearer",
  "expires_in": 14399 
}

access_token - the generated JWT access token
issued_token_type - the type of returned token, always urn:ietf:params:oauth:token-type:access_token
token_type - how to use the token, always Bearer
expires_in - validity of the token in seconds

Machine-to-Machine authentication (Service Accounts)

For server-to-server integrations that don’t involve a human user, create a Service Account in Organization Settings → Service Accounts. Each Service Account provisions a bot user scoped to one or more Phrase products, and authenticates using the standard OAuth 2.0 Client Credentials flow — no API token or token-exchange step needed. Creating a Service Account generates a client_id and client_secret, shown once. Exchange them directly for an access token against the same Phrase Platform OAuth Token endpoint. Supported parameters are:

Parameter name	Value	Required
`grant_type`	`client_credentials`	yes
`client_id`	CLIENT-ID	yes
`client_secret`	CLIENT-SECRET	yes
`resource`	Space-separated list of product UIDs (e.g. `strings`, `tms`) to restrict the token to. Omit to cover every product configured on the Service Account.	no
`scope`	Space-separated list of requested scopes. Must be granted by at least one of the targeted products — a product that doesn’t grant any requested scope is simply left out of the resulting token rather than failing the whole request. Omit to get each targeted product’s full configured scope.	no

Sample request

POST https://eu.phrase.com/idm/oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials&client_id=CLIENT-ID&client_secret=CLIENT-SECRET

With curl:

# EU region
curl -X POST https://eu.phrase.com/idm/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials' \
  -d 'client_id=CLIENT-ID' \
  -d 'client_secret=CLIENT-SECRET'

# US region
curl -X POST https://us.phrase.com/idm/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials' \
  -d 'client_id=CLIENT-ID' \
  -d 'client_secret=CLIENT-SECRET'

The response is in JSON format:

{
  "access_token": "GENERATED-JWT",
  "token_type": "Bearer",
  "expires_in": 14399,
  "scope": "strings:read strings:write tms:default"
}

access_token - the generated JWT access token
token_type - how to use the token, always Bearer
expires_in - validity of the token in seconds
scope - space-separated, prefixed by product UID (e.g. strings:read); a product with no requested/configured scope still appears in the token’s audience without contributing to this claim

Good to know

Bot users show up in product UIs with a bot badge but can’t log in interactively. They can read/write content, run analyses, and work with translation memories — but can’t create or modify human users, or be assigned as project owners. They don’t count toward seat quotas. The only way to remove a bot user is to delete its Service Account.

Using JWT in APIs

Use the token to access Platform APIs of specific application - passing it in HTTP Authorization Header:

Authorization: Bearer GENERATED-JWT

Overview

API Documentation

Exchanging API tokens for JWT

Sample request

Machine-to-Machine authentication (Service Accounts)

Sample request

Good to know

Using JWT in APIs

​Exchanging API tokens for JWT

Sample request

​Machine-to-Machine authentication (Service Accounts)

Sample request

Good to know

​Using JWT in APIs

Exchanging API tokens for JWT

Machine-to-Machine authentication (Service Accounts)

Using JWT in APIs