The wxrks REST API lets you build integrations and scripts against your workspace — creating projects, pulling translation memory, managing users, and more — outside the Portal UI. Every request to the API must carry a short-lived authentication token in the X-AUTH-TOKEN header, which you get by exchanging a permanent API key pair for it.
💡 Who is this for? This guide is for the Account Admin who needs to generate API credentials and authenticate requests to the wxrks REST API.
1. Find your API credentials
API credentials are generated per user, from that user's own profile — there is no separate admin screen for issuing keys to other people. Only a user with the Account Admin role can generate them.
Sign in to wxrks and open your Profile.
Go to the Security tab and find the API Token card.
Click Generate. A confirmation dialog warns that this replaces any existing key pair for your user — click through it to confirm.
A modal shows your API ID and API Secret Key. Copy both immediately: the secret is shown only once and can't be retrieved again, only reset.
The Age in Days field is informational — it just shows how old your current key pair is, so you know when it might be worth rotating.
Generating a new pair immediately invalidates the old one. If you're setting up a shared integration (a CI pipeline, a connector, a bot), create a dedicated wxrks user for it first and generate the key from that account — not from a personal admin account whose key might get regenerated later for unrelated reasons.
2. Exchange your credentials for a token
Requests to the wxrks API don't use your API ID and API Secret Key directly. Instead, you exchange them once for a short-lived token, then use that token on every subsequent request.
Send a POST request to /api/v3/auth on your workspace's host, with your credentials as JSON:
POST https://app.wxrks.com/api/v3/auth
Content-Type: application/json
{
"accessKey": "your-api-id",
"secret": "your-api-secret-key"
}
Most workspaces use https://app.wxrks.com; European workspaces use https://eu.wxrks.com.
A successful response returns your authentication token in the X-AUTH-TOKEN response header — not in the response body, so make sure your client is reading response headers (with curl, that means passing -i or -D -).
3. Use the token on every request
Copy the token from that header and send it back as a request header, named the same way, on every call you make to the API:
GET https://app.wxrks.com/api/v3/projects
X-AUTH-TOKEN: <token from step 2>
You don't need to repeat step 2 for every request — reuse the same token until it expires.
4. Token expiration
The token from X-AUTH-TOKEN expires automatically. When it does, your requests start failing authentication again — at that point, repeat step 2 (POST /api/v3/auth with the same API ID and API Secret Key) to get a fresh one.
You never need to generate a new key pair just because a token expired — the API ID/API Secret Key pair itself stays valid until you explicitly click Generate again on the Security tab. A long-running integration should catch the authentication failure and automatically re-run the exchange in step 2, rather than hardcoding a single token.
5. Restrict API access by IP (optional)
Because an Account Admin's API credentials carry full admin-level access, wxrks also lets you restrict which IP addresses are allowed to authenticate with them. This is separate from your normal Portal login — it only applies to the API key exchange in step 2.
The API IP Whitelist card sits directly below API Token on the same Security tab. Add allowed IPs or CIDR ranges there (up to 5); once at least one is configured, only requests from those IPs can complete step 2 successfully. Use Use last known IP to quickly add the address you're currently connecting from.
Troubleshooting
"Invalid Credentials" on the auth request: your API ID or API Secret Key is wrong, or the key pair was regenerated since you saved it (generating a new pair invalidates the old one immediately). Generate a fresh pair from the Security tab and update wherever you stored it.
Requests are rejected even with a valid key: check the API IP Whitelist card on your Security tab — if any IPs are listed there, requests from any other address are blocked at the authentication step.
Authentication suddenly stops working after several days: your X-AUTH-TOKEN has expired. Repeat the exchange in step 2 with your existing API ID/API Secret Key — you don't need a new key pair.
Related articles
Connecting an AI assistant or terminal tool instead of calling the REST API directly? See MCP and CLI for wxrks — it uses the same API ID/API Secret Key pair from this article, generated from the same Security tab.
Full endpoint reference: wxrks API documentation.