Authentication
Every request carries a Bearer key. Keys are 44 characters, start with rsk_, are hashed at rest, and are shown exactly once at creation.
Authorization: Bearer rsk_your_key_hereKey types and scope
| Key type | Type | Description |
|---|---|---|
| data | read-only | GET /v1/creators/search and GET /v1/creators/{pk} only. Metered in credits against your plan. Created at api.ugcroster.com/keys; requires an active API subscription. |
| brand | full | Every endpoint, including writes (briefs, campaigns, contracts, messages, payouts, webhooks). Unmetered. Included with any Roster brand plan; created in the brand portal under Settings → API & Integrations. |
A data key calling anything outside its scope gets 403 with code BRAND_KEY_REQUIRED. There is nothing to configure: scope follows the key type.
Rotation and revocation
Keys never expire on their own. Revoke and re-mint from the same page that created them; revocation is immediate (validation checks the stored hash and the revoked flag on every request). Up to 5 active data keys per account, so you can cut over with zero downtime: mint the new key, deploy, revoke the old one.
Storage rules
The raw key is returned once, at creation, and never again: only a SHA-256 hash is stored. If you lose a key, revoke it and mint another. Treat keys like passwords: environment variables or a secret manager, never client-side code, never a repository.
What happens if my subscription lapses?
Data keys validate against your subscription on every request. A cancelled or lapsed subscription makes all your data keys return 401 INVALID_API_KEY until the subscription is active again. Keys are not deleted: resubscribing restores them.