Translation API · Concept
Authentication and API Keys
Authenticate server-to-server integrations with a scoped Stepes API key.
Stepes Public API v2 uses one API key directly on every authenticated request.
Create a Key
Create and manage keys in the Stepes client portal under Settings → API keys. If API keys are not available for your account, contact your Stepes account administrator or Stepes support.
The complete secret is displayed once. Copy it into a server-side secret manager before closing the dialog.
Send the Bearer Key
Authorization: Bearer stp_live_<your-api-key>Send requests to https://apis.stepes.com/v2. Your API key identifies the Stepes account, so no separate account identifier is required in the request body.
Live and Test Keys
Use stp_live_... keys for production work. If Stepes provides a stp_test_... key for a test environment, keep it separate from production credentials. A test key cannot create production projects.
Scopes
Each key has explicit scopes such as projects:write, projects:read, files:write, deliveries:read, and webhooks:write. An endpoint page lists the exact scope it requires. Use separate keys when integrations need different permissions or revocation boundaries.
Keep Keys Server Side
- Never embed a key in browser JavaScript or mobile binaries.
- Never place a key in a URL, source repository, log, webhook payload, or customer-visible error.
- Restrict keys with an expiry and IP/CIDR allowlist where practical.
- Rotate a key before revoking the old one; the configured grace period supports controlled cutover.
Authentication Errors
A missing, malformed, expired, revoked, disallowed, or wrong-environment key returns 401. A valid key without the required permission or account capability returns 403. Include Stepes-Request-Id when contacting support.