better-i18n.com
डेवलपर दस्तावेज़सहायता केंद्ररिलीज़ नोट्स

OAuth 2.0

इस पेज पर

Better i18n supports OAuth 2.0 Authorization Code for third-party integrations. Server-side apps use a client_secret (confidential clients); browser-only apps may use PKCE (public clients). If you're building a platform, IDE plugin, or any app that needs to manage translations on behalf of your users, this is how you connect.

How it works #

Code
Your App                        Better i18n
────────                        ───────────
1. Redirect user          →     Consent screen
                                (org + scope selection)
2. Receive auth code      ←     Redirect back with ?code=

3. Exchange code          →     dash.better-i18n.com/api/auth/mcp/token
   for tokens             ←     access_token + refresh_token + grant_id

4. Mint installation      →     POST /api/oauth-client/installations/:grantId/tokens
   token                  ←     bi_oat_... (1h, scoped)

5. Call resource APIs     →     GET /api/oauth-client/v1/projects/:id
                          ←     Scoped project data

Token model #

TokenLifetimePurpose
Authorization code10 minOne-time exchange
Access token30 minMint installation tokens only
Refresh token30 daysRenew access tokens
Installation token (bi_oat_...)1 hourAll resource API calls

Why two layers? #

The access token can mint installation tokens but cannot read resources. The installation token can read/write resources but cannot mint more tokens. This means:

  • A leaked installation token expires in ≤ 1 hour with no path to escalation
  • The user can revoke one partner-org pair without affecting others
  • Partners get fine-grained, per-organization, per-project scoping

Base URLs #

Use the dashboard origin for browser-based OAuth, because the user signs in and approves consent there:

Code
https://dash.better-i18n.com/api/auth/mcp/authorize
https://dash.better-i18n.com/api/auth/mcp/token

Use the API origin for partner resource calls after you have an installation token:

Code
https://api.better-i18n.com/api/oauth-client/...

Three channels, one token #

Once you have a bi_oat_ token, you can use it across:

ChannelHowUse case
REST APIAuthorization: Bearer bi_oat_...Backend automation
MCP ServerBETTER_I18N_API_KEY=bi_oat_...AI agents (Cursor, Claude Code)
CDNNo auth neededRuntime translation delivery

The same scope enforcement applies everywhere — a token without translations:publish can't publish via REST or MCP.