Configuration

The app settings App Translations reads, and how source headers get their values.

App Translations reads its settings from the AppTranslations section of your site’s configuration. Every setting is optional.

Setting	Default	Purpose
`SourceSecurity:AllowPrivateNetworkEndpoints`	`false`	Let sources read from private networks and `localhost`.
`DeploymentSync:ApiKey`	none	Turns on deployment-triggered sync with a secret. A long random value, without spaces. To use an OIDC token instead, register a policy in code.
`Delivery:ApiKey`	none	Requires a key for the delivery endpoints, which are public without one. A long random value, without spaces.
`Delivery:MaxAgeSeconds`	`60`	How long clients and CDNs may keep a delivery response. `0` makes them check every time.

Set them in appsettings.json, or as environment variables, where the separators are double underscores:

{
  "AppTranslations": {
    "DeploymentSync": { "ApiKey": "replace-with-a-long-random-value" },
    "Delivery": { "MaxAgeSeconds": 60 }
  }
}

AppTranslations__DeploymentSync__ApiKey=replace-with-a-long-random-value
AppTranslations__Delivery__MaxAgeSeconds=60

Keep the keys out of source control, in your host’s secret store or user secrets.

A key that contains whitespace stops the site at startup, because it could never match what a client sends.

A source header can name a setting to read its value from, which keeps secrets out of the database. See Sources that need authentication.

Everything else is set in the backoffice, in Settings > App translations: sources and their sync schedules, the AI assistant, and whether Umbraco’s Translation section is hidden while the Dictionary is empty.

One Umbraco setting matters too. Umbraco sends the App translations updated webhook only while Umbraco:CMS:Webhook:Enabled is on, which it is by default.