EzUGC API Authentication

Headers

Either header works.

Authorization: Bearer ezk_live_...
x-api-key: ezk_live_...

Paid check on every request

Keys are issued only to accounts on Startup, Growth, or Pro with an active paid subscription (from $99/month). There is no trial key and no unpaid MCP credential.

Auth middleware reloads the billing profile on each functional call. If the subscription lapses, the same leftover key starts returning HTTP 402. Subscribe, then mint a key in the dashboard.

Status codes

• 401 PUBLIC_API_KEY_REQUIRED — no key, malformed key, revoked key, or expired key.
• 402 PUBLIC_API_SUBSCRIPTION_REQUIRED — key is well-formed, account is no longer paid.
• 402 PUBLIC_API_BILLING_EXPIRED — billing cycle ended; renew and retry.
• 403 PUBLIC_API_SCOPE_DENIED — key is missing a required scope.

First authenticated call

curl -sS https://api.ezugc.ai/api/public/me \
  -H "Authorization: Bearer ezk_live_YOUR_KEY"

GET /openapi.json needs no key. It is documentation only.

Scopes

Keys carry scopes such as ugc:write, video:write, image:write, jobs:read, account:read, brand:read, and brand:write. Required scope is listed on each OpenAPI operation.

MCP and OAuth

The @ezugc/mcp stdio package and the remote MCP connector both send this same key to /api/public/*. Consent for remote MCP also validates the key through the paid check. See the MCP page and the developer portal. Markdown twin: /docs/auth.md.