Authentication

There is one credential to understand — the integration key, used at runtime so your app can read and sync translations for a specific continuous project. It is not your platform login, and it is not needed to install the SDK: the packages are public on npm and require no credential at all.

Installing the packages

The SDK packages are published publicly to the npm registry under the @lionrapid scope. There is no private registry, no .npmrc, and no token:

npm install @lionrapid/core

See the Quickstart for the full install list.

Integration keys (runtime)

Your application authenticates against the platform’s integration endpoints with an integration key. Integration keys are scoped to a single continuous localization project: the key decides which project’s translations your app reads and which project new keys are synced into.

Keys are managed in the app, on the continuous project — you can create several keys per project, toggle a key off temporarily, and revoke a key permanently. See Continuous localization for where this lives in the product.

Practical guidance:

• One key per app or environment. Give staging and production separate keys so either can be revoked without affecting the other.
• Toggling is reversible, revoking is not. Use toggle to pause an integration (for example, while investigating unexpected sync traffic); revoke when a key may have leaked.

How the SDK sends the key

The SDK sends the integration key as an HTTP bearer token. You pass it as apiKey in the network repository options and the client adds the Authorization: Bearer … header to every request:

import { NetworkRepository } from '@lionrapid/core';

const network = new NetworkRepository({
  enabled: true,
  options: {
    baseUrl: 'https://your-lionrapid-host',
    apiKey: process.env.LIONRAPID_INTEGRATION_KEY,
  },
});

The same applies when you call the integration endpoints directly (for example from a backend service or the WordPress plugin): send the key as a bearer token in the Authorization header. The endpoints themselves are documented in the Platform API reference.

Secrets in CI

Installing the SDK in CI needs no credential — the packages are public. What can appear is a server URL for type generation, and the integration key itself if a build step talks to the platform.

• Store keys in your CI provider’s secret store, never in the repository.
• Expose them as environment variables so build scripts stay credential-free. For example, in GitHub Actions:

steps:
  - uses: actions/checkout@v4
  - uses: actions/setup-node@v4
    with:
      node-version: 20
  - run: npm ci
  - run: npx lionrapid types generate --server
    env:
      LIONRAPID_API_KEY: ${{ secrets.LIONRAPID_API_KEY }}

• The integration key is a runtime secret. Server-side apps should read it from the environment. Note that any key shipped inside a browser bundle is visible to end users — treat browser-exposed keys as revocable-by-design and scope them to a project you are comfortable exposing.

Quick reference

Credential	Used for	Where it lives
Integration key	Runtime reads and sync	apiKey in the network config