EzUGC API Authentication

Discover

The public API authenticates with a paid-account API key, not OAuth. Agents can read the method from this page, from /docs/auth.md, from OpenAPI securitySchemes at https://api.ezugc.ai/openapi.json, and from RFC 9728 protected-resource metadata at https://api.ezugc.ai/.well-known/oauth-protected-resource. That document describes bearer API keys for https://api.ezugc.ai. There is no public OAuth authorization server, register_uri, or claim_uri.

Pick a method

Use one header. Both send the same dashboard-issued ezk_live_ key. There is no OAuth client, client_id, or redirect for the public API.

Authorization: Bearer ezk_live_...
x-api-key: ezk_live_...

Use the credential

Keys are issued only to accounts on Startup, Growth, or Pro with an active paid subscription (from $99/month). There is no trial key and no unpaid MCP credential. Auth middleware reloads the billing profile on each functional call.

Create a key in the dashboard, then confirm with GET /api/public/me. GET /openapi.json needs no key.

curl -sS https://api.ezugc.ai/api/public/me \
  -H "Authorization: Bearer ezk_live_YOUR_KEY"

Errors

• 401 PUBLIC_API_KEY_REQUIRED — no key, malformed key, revoked key, or expired key.
• 402 PUBLIC_API_SUBSCRIPTION_REQUIRED — key is well-formed, account is no longer paid.
• 402 PUBLIC_API_BILLING_EXPIRED — billing cycle ended; renew and retry.
• 403 PUBLIC_API_SCOPE_DENIED — key is missing a required scope.

Failures return application/json with { error, code, message, hint }.

Scopes

Keys carry scopes such as ugc:write, video:write, image:write, jobs:read, account:read, brand:read, and brand:write. Required scope is listed on each OpenAPI operation.

MCP

The @ezugc/mcp stdio package and remote Streamable HTTP at https://api.ezugc.ai/mcp both send this same paid API key. Set EZUGC_API_KEY for stdio, or send Authorization: Bearer / x-api-key to the remote endpoint. See the MCP page and the developer portal. Markdown twin: /docs/auth.md. Agent notes: AGENTS.md. Subscribe if the leftover key starts returning HTTP 402.