This integration supports Crowdin Enterprise only. crowdin.com accounts that aren’t part of an Enterprise organization can’t be connected. Each integration connects one Crowdin Enterprise organization. If you have more than one, add an integration for each. See Multi-instance support.
What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Crowdin Enterprise organization:-
Accounts - every organization member, whether active, blocked, or invited but not yet joined. Members of linked vendor and client organizations appear as external users. For each member, Oleria shows:
- Name, username, and email.
- Status - blocked members show as disabled. Invited members who haven’t accepted show as enabled but inactive.
- Account role - Admin, Manager, Vendor, Client, or Member. Admins are marked as administrators.
- MFA - from the member’s two-factor authentication and device verification settings, and your organization’s two-factor policy.
- Single sign-on (SSO) and login methods - the methods the member signs in with, such as password, SAML or OpenID Connect, social sign-in, or passkey.
- Last seen - the member’s last activity in Crowdin, used for dormant account detection.
- Last password change - the most recent password change or password set event in the security log.
- API access - whether the member has any personal access tokens.
- Teams - every team and its members.
-
Roles:
- Organization roles - Admin, Manager, Vendor, and Client. Admins have full access to every project and group.
- Group Manager - one per project group, held by the group’s managers. It grants access to the group and every subgroup and project in it.
- Project roles - Project Manager, Developer, Proofreader, Translator, and Language Coordinator, one set per project. Project roles are held by members and by teams added to the project. For language roles, the languages they cover are shown on the access entry.
- Resources - every project and project group, with the groups nested as they are in Crowdin. A project’s creator is shown as its owner.
- Public access - an Anyone (public projects) account stands for anyone outside your organization. It has translate access to projects with crowdsourcing turned on, and read access to projects with public downloads turned on.
-
Non-human identities (NHIs) and credentials:
- Activity - events from the organization security log, attributed to the member who performed them: sign-ins, password and email changes, two-factor and SSO changes, personal access tokens issued and revoked, sessions revoked, members registered, blocked, unblocked, and removed, apps connected and disconnected, team membership changes, admin and group manager grants, and changes to authentication and organization settings. Other events keep their Crowdin event name.
Crowdin has no AI agent objects, so none appear. A Crowdin App’s agent user is a bot account that the app acts as, and is shown as a service account.
Prerequisites
- A Crowdin Enterprise organization. Teams and SAML single sign-on are available on the Business plan or higher. If your plan restricts some data, Oleria skips teams, team project roles, and the organization’s sign-in and two-factor settings, and syncs everything else.
- A Crowdin Enterprise organization Owner or Admin to create the personal access tokens. Oleria refuses a token whose user isn’t an Owner or Admin: for other users, Crowdin hides member emails, two-factor authentication, sign-in methods, token counts, and other members’ security-log events.
- Admin access on the Oleria platform to add a new integration.
Create the tokens from a dedicated admin account that isn’t tied to an employee, such as
oleria-governance, so the integration keeps working if that person leaves or loses admin rights. Oleria also refuses to block or delete the token’s own user, or to remove its roles, team membership, or project access, so a dedicated account can’t be locked out from Oleria by mistake.Create personal access tokens in Crowdin
Oleria uses a read-only personal access token for discovery. To run remediation actions, you can add a second token with read and write access. Keeping them separate means the token used on every sync can’t change anything in Crowdin.The exact location of these settings can change over time. If the steps below don’t match what you see, refer to Crowdin’s personal access tokens and scopes documentation.
1
Open the access token settings
Sign in to your Crowdin Enterprise organization,
https://<organization>.crowdin.com, as the dedicated Owner or Admin account. Select your profile picture in the upper-right corner, select Account Settings, and open Access tokens (shown as API in some versions of Crowdin). Select New Token.2
Create the read-only token
Enter a name, such as
Oleria (read), and choose an expiration date. Select these scopes, each with Read only access:Leave Granular access off. With granular access on, the token reaches only the projects and groups you select, and the rest of your organization doesn’t appear in Oleria.Select Create, then copy the token. Crowdin shows it only once.
3
Create the read and write token (optional)
To let Oleria run remediation actions, select New Token again and create a token such as
Oleria (write), with Granular access off. Select these scopes with Read and Write access:Select Create, then copy the token.If you don’t add this token, Oleria runs actions with the read-only token, and they fail with a missing-scope error.
Crowdin tokens don’t expire by default, and your organization may set a maximum token lifetime. If you set an expiration date, add a reminder to create a new token and update the integration before it expires. When a token expires, the integration stops syncing, or actions stop working, until you update it.
Connect Crowdin to Oleria
1
Find your organization domain
Your organization domain is the
<organization> part of your Crowdin Enterprise address, https://<organization>.crowdin.com. For example, for https://acme.crowdin.com, enter acme. You can also paste the full address. Oleria keeps only the organization part.2
Open the integration
Go to your Oleria workspace, select Integrations, select the Available tab, and search for Crowdin.
3
Complete the connection form
Select the Crowdin card and fill in the connection form:
4
Authenticate
Select Authenticate. Before saving the integration, Oleria checks that each token is valid, belongs to this organization, and belongs to an organization Owner or Admin. Oleria also checks that the read-only token has every scope it needs. The read and write token’s scopes are checked when an action runs.
- Crowdin rejected … (401) - the token is invalid or has expired. Create a new token.
- … belongs to another Crowdin organization - the token was created in a different organization. Sign in to
https://<organization>.crowdin.comand create the token there. - The user of … is not an organization Owner or Admin - create the token as an organization Owner or Admin.
- The read token lacks these Crowdin scopes (add them with Read only access): … - edit the read-only token in Crowdin and add the listed scopes with Read only access, or create a new token with every scope in the table above.
Verify the integration
Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, review the discovered accounts, teams, roles, projects, NHIs, and activity in your Oleria workspace. If your Crowdin plan doesn’t include some data, such as teams, Oleria skips only that data and syncs everything else. If something you expect is missing, check that the read-only token has every scope in the table above.Remediation actions
Oleria can take these actions in Crowdin. Each action needs the read and write token, created by an organization Owner or Admin, with the scopes listed above.
A few safeguards apply to every action:
- Oleria won’t block or delete the token’s own user, or remove its roles, team membership, or project access. Doing so would disconnect the integration.
- Oleria won’t delete an Admin unless at least one other active (not blocked) Admin remains. You can delete a blocked Admin while another active Admin remains. Crowdin refuses changes to the organization Owner.
- Oleria won’t uninstall a Crowdin App that Crowdin installed itself.
- Access a member gets from a team or from Group Manager on the project’s group stays in place when you revoke their project access. Remove them from the team, or remove their Group Manager role, instead.
- If a member already has the state an action asks for, the action succeeds and changes nothing.
Known limitations
- Personal access tokens and OAuth app authorizations aren’t inventoried. Crowdin has no API to list or revoke them. Oleria shows whether a member has API access, and token issue and revoke events appear as activity. To review or revoke tokens, an Admin can open Organization Settings > User access tokens in Crowdin, which lists every member’s tokens with their last-used and expiry dates. Manage OAuth apps under Organization Settings > OAuth apps.
- Some security settings are available only in the Crowdin UI. SAML configuration, Enforce SAML, IP allowlists, session settings, and the organization API log aren’t available through the API. Changes to these settings appear as security-log activity, and each member’s SSO status is inferred from their login methods.
- Failed sign-ins aren’t recorded. Crowdin’s security log records successful sign-ins only. Project permission changes and content access aren’t in the log either.
- No custom roles. Crowdin has fixed roles only, and teams can’t be nested.
- The organization Owner is shown as an Admin. Crowdin’s API doesn’t tell the Owner apart from other Admins. Workspace Managers aren’t shown, because the API has no field for them.
- Language roles can’t be granted from Oleria. Translator, Proofreader, and Language Coordinator need a language selection that the action doesn’t carry, so grant them in Crowdin. Oleria also refuses to grant Developer to a member who holds language roles on the same project, because Crowdin would replace those roles. For a member who holds Project Manager or Developer access together with any language role on the same project, Oleria refuses to add or remove project roles before anything changes. Manage that member’s roles in Crowdin. You can remove a language role from Oleria for any other member. Removing Developer from a Project Manager isn’t supported, because developer access is part of that role. Remove Project Manager instead.
- Team and group access to a project can’t be removed from Oleria. Revoking project access removes only a member’s direct project roles. Remove the member from the team or remove their Group Manager role, or remove the team from the project in Crowdin.
- Organization roles other than Admin can’t be changed. Manager, Vendor, and Client follow from project and group grants, or from the linked vendor or client organization.
- Some data depends on your plan and settings. Teams and SAML need the Business plan or higher. When your plan restricts data, Oleria skips teams, team project roles, and the organization’s sign-in and two-factor settings, and syncs everything else. Group managers appear only when your organization uses them.
- Crowdin Apps, agent users, and webhooks have no last-used date. Crowdin doesn’t report when they were last used.