Publishable keys

A publishable key is the id the in-context editor sends from the browser. It starts with taip_, it is meant to be public, and it is safe to ship in client code: on its own it can only open a short-lived, read-only session, and only from the origins you list on the key. Saving needs a second step that only your backend can perform.

Publishable keys are available on the Starter plan and above, and only project admins can create or delete them.

Create a keyCopy Anchor Link

You can create a key in two places. Both create the same kind of key.

Unlike API tokens and CDN keys, a publishable key stays visible in the list, so you can copy it again at any time. Each key shows its allowed origins and when it was last used.

Allowed originsCopy Anchor Link

The editor only starts a session when the browser's Origin matches one of the key's allowed origins exactly:

• An origin is scheme://host[:port]: https://app.example.com, http://localhost:5173. There are no wildcards, so list every subdomain you need.
• The scheme and port must match; the host is compared without regard to case. A path is ignored.
• Browsers leave the default port out of Origin, so write https://app.example.com, not https://app.example.com:443.
• List your development and staging origins too, or use a separate key for them.

The usual way to organise this is one key per app or environment, so you can delete one without affecting the others.

SessionsCopy Anchor Link

When the editor mounts, it exchanges the publishable key for a session:

1. The browser sends the key to POST https://api.transglot.ai/v1/incontext/session.
2. transglot checks that the key exists, that the request's origin is on its list, and that the account's plan includes the in-context editor.
3. It returns a session token for the key's project. Without a write nonce (below), the session can read strings but not change them.

A session lasts about 15 minutes. The SDK renews it a minute before it expires (calling getNonce again, if you set it) and keeps the token in memory only: never in localStorage or sessionStorage. Session requests are rate-limited per key and client address.

An unknown or deleted key, an origin that is not on the key's list, and a nonce that was already used or has expired all return the same 403 with the problem type origin-not-allowed. That is deliberate: nobody can use the answer to find out which keys exist. A plan without the in-context editor returns 403 plan-limit.

Grant write accessCopy Anchor Link

Because the publishable key is in your page source, anyone can copy it. So it never grants write access. To let a reviewer save, your backend vouches for them with a nonce:

app.post('/api/transglot-nonce', requireReviewer, async (req, res) => {
  const keys = keysThisUserMayEdit(req.user, req.body.keys);

  const response = await fetch('https://api.transglot.ai/v1/incontext/session-nonce', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.TRANSGLOT_TOKEN}`,
      'Content-Type': 'application/json',
      Accept: 'application/json',
    },
    body: JSON.stringify({
      publishable_key: 'taip_your_publishable_key',
      keys,
    }),
  });

  if (!response.ok) {
    res.json({ nonce: null });
    return;
  }

  const { nonce } = await response.json();
  res.json({ nonce });
});

The nonce requestCopy Anchor Link

POST https://api.transglot.ai/v1/incontext/session-nonce, authenticated with a project token that has the write ability.

The response is { "nonce": "...", "expires_at": "..." }. A nonce:

• can be used once,
• expires about a minute after it is issued,
• works only with the publishable key it was issued for.

A session token from the editor cannot request a nonce. Only a project token from your own backend can.

Delete a keyCopy Anchor Link

In the Publishable keys card, select Delete next to the key and type its name to confirm. Every editor embedded with that key stops working at once, and its open sessions end. If the editor is in production, create a replacement key, deploy it, then delete the old one.

RelatedCopy Anchor Link

• Install the in-context editor
• Connect the in-context editor
• Project developer settings