With a project deploy token as a bearer credential. It matters that you pick the right kind of credential, because transglot issues three and they are not interchangeable.
Who this is for
Developers.
What happens next
Deploy tokens are the API credential. Minted per project from Settings → Developer, sent as a bearer token, and limited to the abilities you gave them when you created one. This is what the command line tool, CI, the editor plugins and your own scripts use.
CDN keys are read-only and can do exactly one thing: fetch that project's already-published bundles. They are not API tokens and will not work against the API.
Publishable keys are for the in-context editor, are meant to sit in a browser, and are restricted by the site addresses you allow rather than by being kept secret.
Three things that catch people out:
Abilities are enforced per endpoint. A token that can pull cannot push, and neither can start a translation run.
Tokens are project-owned, not personal. They keep working after the person who minted them leaves, so revoke them explicitly.
A workspace that is suspended or pending deletion refuses every request on the token, reads included.
Every secret transglot issues is shown once at creation and stored hashed. There is no "show me the token again".
Related
Create a deploy token
The public API
The CDN