Project developer settings

Open the project, then Settings → Developer. The page holds four sections, each with its own list and create dialog. Admins see all four; the page is not shown to members who cannot manage the project's tokens.

See pricing for what each plan includes.

How secrets are handledCopy Anchor Link

Deploy tokens, CDN keys and webhook signing secrets are shown once, in the dialog that appears right after you create them. transglot stores only a hash, so the value can never be shown again. Copy it straight into the place that uses it. If you lose one, create a replacement, roll it out, then delete the old one.

Publishable keys are the exception. They are public by design, restricted by the origins you allow rather than by secrecy, and they stay listed so you can copy them again.

API tokensCopy Anchor Link

"Project-owned tokens for the CLI and CI. The token value is shown only once, at creation."

Select New token, then fill in Name, Abilities and Expiry in the Create API token dialog. The list shows each token's abilities, when it was last used and when it expires, with Revoke on every row.

Abilities, expiry, storage and rotation are covered in Deploy tokens.

Publishable keysCopy Anchor Link

"Public taip_ ids for the in-context editor SDK. Safe to embed in client JS. Each is bound to an allow-list of origins and only mints short-lived, origin-checked session tokens."

Select New publishable key. In the Create publishable key dialog, give it a Name and list its Allowed origins: "Exact scheme://host[:port] origins allowed to mint a session (no wildcards)." Type each origin, such as https://app.example.com, and select Add, then Create key.

Your new publishable key shows the key to pass to <TransglotProvider publishableKey>. The list shows each key's allowed origins and when it was last used, with Delete on every row.

See Publishable keys and Install the in-context editor.

WebhooksCopy Anchor Link

"POST a signed event to your endpoint when something changes."

Select New endpoint. In the Create webhook endpoint dialog, enter the Endpoint URL, choose the events, and select Create endpoint. Copy your signing secret then shows the secret once: "This secret is shown only once. Store it in your consumer now to verify the X-Transglot-Signature header. It cannot be recovered later."

The list shows each endpoint's events and when it last delivered. Its Active switch pauses or resumes deliveries; events that happen while an endpoint is paused are not sent later. Deliveries opens Recent deliveries, with each attempt's status, response code, attempts and next retry. Delete removes the endpoint.

If the account's plan does not include webhooks, or the workspace is frozen, the section says deliveries are paused. Your endpoints and their settings are kept, and delivery resumes once the workspace is back.

See Create a webhook endpoint, Webhook events and Verify signatures.

Runtime delivery (CDN)Copy Anchor Link

"Serve published strings over an edge-cacheable URL. Fix a prod typo without shipping a build."

• Freshness decides when a version is published: Manual: publish explicitly, or Auto: publish on every push.
• Delivery format is the file shape a bundle is served in. Project default follows the project's own export format.
• Each locale shows its published version, Publish now, its Latest URL and, once published, its Immutable URL. Immutable /v<n> URLs cache for a year; the latest URL revalidates with an ETag.

CDN keys: "Read-only taicdn_ keys authorize a CDN fetch. Pass one in the X-Transglot-Cdn-Key header (or ?key= for browser fetches). Shown once on creation." Type a Name and select New CDN key. Deleting a key makes every fetch that uses it fail with a 401 straight away, so roll out a replacement first.

On a plan without runtime delivery, the section shows "Runtime delivery unlocks on the Starter plan." Published versions and their URLs stay visible.

See The CDN and Connect your app to the CDN.