Today we'll talk about Weglot API keys.

What is Weglot?

Weglot is a paid translation service used by many websites to provide multilingual content. It works through an API that handles translation requests.

How I Found It

While testing websites, I checked the page source and JavaScript files.

A common indicator was keys or variables starting with:

wg_

Sometimes these values appeared directly in the HTML source, and sometimes inside linked .js files.

Quick Recon Method

  1. Open the target website
  2. View page source
  3. Search for: weglot
  4. Search for keys starting with: wg_

If you find an exposed API key, test whether it is still active.

Proof of Concept Request

I tested the key using a translation request like this:

curl -X POST \
'https://api.weglot.com/translate?api_key=wg_*******' \
-H 'Content-Type: application/json' \
-d '{
  "l_from":"en",
  "l_to":"fr",
  "request_url":"https://www.google.com/",
  "words":[
    {"w":"This is a blue car","t":1},
    {"w":"This is a black car","t":1}
  ]
}'

If the API returns translated content successfully, the key is active and usable.

Why This Matters

An exposed third-party API key can lead to:

  • Unauthorized use of a paid service
  • Resource abuse
  • Unexpected billing costs
  • Loss of control over external integrations

My First Accepted HackerOne Report

I submitted this issue to HackerOne, and it was accepted.

That made it one of the most memorable findings in my journey.

How I Found It on 5 Different Targets

After understanding the pattern, I scaled the research.

I used technology fingerprinting platforms such as:

  • Wappalyzer
  • BuiltWith
  • PublicWWW

These platforms helped me identify websites using Weglot.

Then I filtered targets that had public bug bounty programs and tested them responsibly.

Key Lesson

Sometimes one small finding can become multiple valid reports when you:

  • Understand the root cause
  • Identify reusable patterns
  • Scale ethically
  • Stay within scope

Final Thoughts

This was an important milestone for me because it showed that smart recon and pattern recognition can be more valuable than random testing.

Always test responsibly and follow each program's rules.