Secret key

Your API key works in the browser, where allowed domains protect it. A server has no domain to check, so content you translate on a server, with React SSR, Next.js or Angular prerendering, uses a secret key instead.

Secret keys start with p-. Keep yours on the server and never put it in code that runs in the browser.

Create a secret key

Open your account page and click Create secret key under Your secret key. The key is shown only once, so copy it right away. Afterwards the account page only shows its last four characters.

You have one secret key at a time. If it leaks, or you lose it, click Regenerate secret key. The old key stops working immediately.

Use it on your server

Set the key as the MAGIC_TRANSLATE_SECRET_KEY environment variable wherever your app renders or builds, for example in your hosting provider's settings or your CI secrets.

MAGIC_TRANSLATE_SECRET_KEY=p-...

On a server, the Magic Translate clients send this key instead of your API key. You don't need to change any code. You can also pass it explicitly:

import { setupT } from '@magic-translate/react-ssr';

export const translate = setupT({
  secretKey: process.env.MAGIC_TRANSLATE_SECRET_KEY
});

In the browser, the clients never send a secret key, even one passed as apiKey. They log an error instead.

Secret keys need @magic-translate/react-ssr 1.3.0 or @magic-translate/angular 1.2.0 or later.

When you need one

Requests that send a secret key from a browser return the error SECRET_KEY_IN_BROWSER. A secret key ignores your allowed domains and works from any server.