Authentication

API keys

• Create keys in the dashboard. Live keys start with ugc_live_.
• The full key is shown once, when you create it. We store only a hash, so we can't show it again.
• Name each key by where it runs, like prod-backend or n8n, so you know which one to revoke.
• You can have several keys at once and revoke any of them from the dashboard.

Sending the key

Send the key in the Authorization header as a Bearer token. Query string keys are not accepted.

curl https://ugcapi.dev/v1/usage \
  -H "Authorization: Bearer ugc_live_..."

const res = await fetch("https://ugcapi.dev/v1/usage", {
  headers: { "Authorization": "Bearer " + process.env.UGCAPI_KEY },
});
const usage = await res.json();

GET /v1/usage is a good first call to test a key. It returns your credits left and posts this month.

Errors

A missing, malformed or revoked key returns HTTP 401:

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key."
  }
}

Common causes: no Bearer prefix, whitespace or a newline copied with the key, or a key that was revoked. See errors for all codes.

Keeping keys safe

1. Call the API from your server only. Never ship a key in a browser bundle or mobile app.
2. Store keys in environment variables or your platform's secret store, not in code.
3. Use a separate key per environment and per integration.
4. Rotate by creating a new key, deploying it, then revoking the old one. There's no downtime.
5. If a key leaks, revoke it in the dashboard right away. A leaked key can spend your credits and post to your connected accounts.

Dashboard sessions

The dashboard uses its own session login, separate from API keys. API keys can't sign in to the dashboard, and dashboard sessions can't call /v1. To post from a no-code tool, see n8n and Make. To get started, follow the quickstart.