Why Google Translate API doesn't accept API-Key in JSON request body?

Question

I'm new to use Google Could Platform.

I tried Translation API's tutorial. By some reason I want to use API-Key for its authentication. but API doesn't accept key in JSON Request, though it accepts same key in HTTP query parameter.

Is this a restriction of Google Translation API? or do I have any mistake?

Following is what I tried:

Worked when API-key is passed as a query parameter

$ curl -H 'Content-Type: application/json' 'https://translation.googleapis.com/language/translate/v2?key=xxxxxxxxxx' --data-binary @test.json

with my test.json is:

{
  "q": "The quick brown fox jumped over the lazy dog.",
  "source": "en",
  "target": "es",
  "format": "text"
}

result was:

{
  "data": {
    "translations": [
      {
        "translatedText": "El rpido zorro marrn salt sobre el perro perezoso."
      }
    ]
  }
}

But for some security reason, I don't want to pass this API-key by query string.

Why I don't want to use query-string

An URI with sensitive parameter is not safe, for it is often logged or is shown in some situation, while HTTP Header or HTTP body aren't.

Of course using stronger authentication method (Service Account) is better for security, but API-key is also a good solution for some use cases like embedding in legacy-system, or so.

Didn't work when Api-key is passed in JSON request

I set "key" item in my request JSON, and it didn't work. It caused authorization error.

curl -H 'Content-Type: application/json' 'https://translation.googleapis.com/language/translate/v2' --data-binary @test.json

with test.json:

{
  "key": "xxxxxxxxxx",
  "q": "The quick brown fox jumped over the lazy dog.",
  "source": "en",
  "target": "es",
  "format": "text"
}

result:

{
  "error": {
    "code": 403,
    "message": "The request is missing a valid API key.",
    "errors": [
      {
        "message": "The request is missing a valid API key.",
        "domain": "global",
        "reason": "forbidden"
      }
    ],
    "status": "PERMISSION_DENIED"
  }
}

Answer 1

The only working example I could find was:

Append the key in the URL, e.g.:

https://translation.googleapis.com/language/translate/v2?key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Do the rest in POST.