Localazy vs Lokalise

Localazy 37

Bearer tokens in the Authorization header. A project token reaches every endpoint of one project with read and write access; a translation token reaches only the AI Translation endpoint; organisation tokens are in beta on request (20). The translation token is the only least-privilege option, and project tokens can delete keys and glossary items without a confirmation step (10). The API returns strings written by translators and contributors, with no guidance on untrusted content (5). No per-call log or audit trail for tokens found (2). localazy.com/.well-known/security.txt and /security return 404, and we found no disclosure policy or certification (0). 20+10+5+2+0 = 37.

Lokalise 73

OAuth 2 with read and write scopes per resource, and personal API tokens that are read-only or read/write and revocable. Tokens never expire and carry all of the creating user's access, and the MCP server adds PKCE and dynamic client registration (26 of 30). Read-only tokens, scopes and role-based project permissions limit access, but no confirmation step was found for calls such as emptying a project (13 of 20). The API returns strings written by translators and contributors, and no guidance on untrusted content was found in the reviewed documentation (3 of 15). GET /v1/audit-logs returns team audit events in OCSF 1.3.0, and the security page says logs are kept 12 months (13 of 15). security.txt valid to 20 August 2027, a disclosure policy at vdp.lokalise.com, a private bug bounty on YesWeHack, SOC 2 Type II, ISO 27001 and ISO 27017 per the security page (18 of 20).

Localazy 51

No OpenAPI or other machine-readable contract was found (0). localazy.com/llms.txt is a six-link index of top-level pages, with no Markdown docs for agents (5). Each endpoint page states which token types can call it, whether write permission is needed and the minimum role, and the limits page says to use the CDN, not the API, for production fetches (14). Request bodies list required and optional fields with limits, such as 512 characters for a key and 1,000 for a comment (12). Sample requests, responses and error responses per endpoint (13). Docs pages carry 'last updated' dates and the blog posts dated release updates, but there's no API version or changelog (7). 0+5+14+12+13+7 = 51.

Lokalise 76

Three public OpenAPI 3.0.3 files, the default-projects one with 63 paths and 109 operations (25). llms.txt with 182 reference links and a Markdown twin of each page (10). Every operation has a description that names the admin right and OAuth scope it needs and which project types it works on, with little on when not to call it (14 of 20). 65 enums and required fields marked, but boolean flags are numbers 0 and 1 and many filters are comma-separated strings (9 of 15). 213 examples, but 108 of 109 operations document only the 200 response and the error list is one general page (8 of 15). The path is versioned at /api2 and there is a dated API changelog, whose newest entry is 29 May 2025 while later API changes appear only in the product changelog (10 of 15).

Localazy 57

Editorial half only. Closed service under terms that name Localazy s.r.o. of Brno and Czech law; the CLI is BSD-3-Clause and the API client MIT (15). The privacy policy keeps data while the service is used and 24 months after, and includes a DPA, but says nothing on whether content sent to Localazy AI is used for training (15). No deprecation policy or dated notices found (0). The DPA links a list of suppliers and subprocessors on an external knowledge base we didn't read (10). 15+15+0+10 = 40.

Lokalise 81

Closed service with a published Master Service Agreement, and the CLI and SDKs under BSD 3-Clause (15). Privacy policy of March 2026 (still the date on 1 November), a DPA dated 21 March 2023, an AI statement and a sub-processor list. The agreement deletes inactive account data after 30 days. The privacy policy says customer data doesn't train general-purpose models, and the AI statement says it can train Lokalise's own models with consent. We did not read the DPA PDF (22 of 30). No deprecation policy found. The API changelog carries dated notices from 2021 and 2022, and the Developer Program Agreement allows changes to API access with or without notice (6 of 20). Sub-processors listed with purpose and location, updated 1 August 2026, and customer data hosted on AWS in EU regions (20).

Localazy 68

Hosted lines, for the REST API at api.localazy.com. Better Stack status page with Web, API, Public API, Payments and Connect API components and 30, 60 and 90-day uptime (20). The incidents page reports none for September, October or November 2026, but the Public API shows 99.805% uptime in one 30-day bucket, roughly an hour and a half of downtime with no incident posted, so the line is held below clean (25). Limits per plan of 100 requests a minute and 10 a second, plus daily import and fetch caps per project (15). No 429 or retry guidance found in the API docs (0). No SLA found on the pricing page or in the terms (0). The core API is GA; the AI Translation endpoint is marked beta (8). 20+25+15+0+0+8 = 68.

Lokalise 84

Graded on the REST API with the hosted lines. Statuspage site at status.lokalise.com with five components and history back to 2022 (20). In the 90 days to 1 November 2026, a 42-minute search outage on 17 August marked critical (search only, partial), three hours of partial email delivery failures on 14 September, and on 21 October an emergency maintenance window, announced on the status page at 07:49 UTC for 14:00 to 15:00 and extended at 14:39, in which the application, the API and Lokalise Messages were offline from 14:00 until 15:30 UTC per the postmortem (16:00 per the completion post) to patch PHP CVE-2026-109618 and CVE-2026-109619. Maintenance announced on the status page before it starts isn't counted as an incident, as akeyless's 11 October window was read, so the record holds minor incidents only (20 of 30). Limits published as 6 requests a second per token and per IP and 10 concurrent requests per project (15). 429 is documented with advice to back off exponentially, and responses carry X-RateLimit-* headers, but no Retry-After is documented and writes take no idempotency key (9 of 15). The Master Service Agreement commits to 99.5 per cent a month with service credits, per the 8 October check, not re-read on 1 November (10). The REST API is generally available, while the MCP server and the new Vantage API are in beta (10). 20+20+15+9+10+10 = 84.

Localazy 75

@localazy/api-client 2.3.2 on 26 October 2026 (30). Releases 2.3.0 (12 August), 2.3.1 (29 September) and 2.3.2 (26 October) in the last 90 days (20). Support by email, blog release updates, and public GitHub repositories, but we didn't read issue reply times (7). The TypeScript client and the CLI (2.0.12 on 31 July 2026) are current (13). The client repository shows coverage badges; we didn't confirm CI runs (5). 30+20+7+13+5 = 75.

Lokalise 84

python-lokalise-api 5.0.0 on 26 October 2026 (Python 3.11 or later, announced in 4.3.0), @lokalise/node-api 17.0.0 and 17.0.1 on 23 October (Vantage API client) and a product changelog entry on 23 October (30). Since 3 August, six Node SDK releases, three Python releases and 15 dated changelog entries (20). Public changelog and 24/7 support listed on the pricing page. The CLI still has no release since v3.1.7 of 14 July 2026, and its 62 open issues and pull requests rest on the 8 October count (11 of 15). Official SDKs are current (15). The Node SDK runs CI on GitHub Actions across Node 22 to 26 and needs Node 22.19 or later, and the CLI builds with GoReleaser (8 of 10).

Localazy 62

API reading. List endpoints return whole projects, files and keys with few output controls (13). Filtering by file, language and tags, and batch imports of up to 1,000 keys and 50 files a request (14). Error responses are documented per endpoint, with HTTP codes and messages (12). No idempotency keys, and the docs warn against parallel imports into the same new file (8). Official TypeScript API client, a CLI and Android and iOS libraries, with few required fields (15). 13+14+12+8+15 = 62.

Lokalise 69

API reading of the checklist. include_translations, include_comments and similar flags and a limit size the responses, and the MCP server splits its tools into two toolkits of 22 and 16 documented actions (18 of 25). Page and cursor paging with X-Pagination-* headers and filters by tag, file name, platform and untranslated state (20). Errors carry a code and a message, and bulk calls return an error per failed item, but messages are short and codes are HTTP statuses only (13 of 20). No idempotency key was found in the OpenAPI files, and we could not read the MCP tool annotations without an account. File imports return a process to poll (4 of 20). Few required fields (one on a task, three on an upload) and official clients for Node, Python, Ruby and PHP plus a CLI written in Go (14 of 15).