Authentication

Every endpoint except /health needs an API key. There are no OAuth flows, no signed requests and no session cookies.

Sending the key

The canonical form is a bearer token:

POST /v1/translate HTTP/1.1
Host: api.vizvuz.com
Authorization: Bearer vz_live_xxxxxxxx
Content-Type: application/json

For compatibility with existing DeepL clients, two further forms are accepted and behave identically:

Authorization: DeepL-Auth-Key vz_live_xxxxxxxx

DeepL-Auth-Key: vz_live_xxxxxxxx

If more than one is present, Authorization wins.

Key format and modes

Test keys exist so that staging traffic is visible as such in your usage breakdown. They are not a sandbox: they call the same engine, produce the same output and consume the same characters. There is no free fake mode, because a fake mode would tell you nothing about quality or latency.

Storage and recovery

We store the SHA-256 hash of the key. The plain key exists exactly once, in the response of the creation call. There is no recovery path — if a key is lost, revoke it and create a new one.

Rotating a key without downtime

1. Create a second key in the dashboard.
2. Deploy the new key to your application.
3. Watch last used on the old key until it stops moving.
4. Revoke the old key.

A revoked key answers 401 with the code key_revoked — distinct from unauthorized, so your monitoring can tell a rotation mistake from a typo.

Scope of a key

A key belongs to a team, not to a user. Quota, credit, rate limit, glossaries and usage records all live at the team level.

Errors

Keeping keys out of your repository

• Read the key from an environment variable, never from source.
• Never send a live key to a browser — the API is a server-to-server interface.

A key in front-end JavaScript is a key anyone can copy.

• If you need translation in a browser, proxy through your own backend and apply

your own rate limit there.

Last updated Sep 1, 2026, 12:00 AM