Access keys (SigV4 credential pairs)
Allow-list of {accessKeyId, secretAccessKey}. An unknown access key gets UnrecognizedClientException (403); a known key with a wrong secret / tampered body gets InvalidSignatureException (403). The credential scope must name the region below and the service "translate".
Region and latency
Region is checked against the credential scope (mismatch → InvalidSignatureException "Credential should be scoped to a valid Region"). Latency is injected after authentication, before the operation runs.
Forced failure and recent translations
POST /__control/force-failure {code, status?, once?} makes every (or the next) authenticated call answer that AWS exception; {code: null} clears it.
Requests from the backend
Danger zone
wipes payments, logs and every runtime override — back to configured defaults