Authentication
Every request carries a Bearer key. Keys are 44 characters, start with rsk_, are hashed at rest, and are shown exactly once at creation.
Authorization: Bearer rsk_your_key_hereKey types and scope
| Key type | Type | Description |
|---|---|---|
| data | read-only | Creator search, stored profile reads and free usage checks. Created at api.ugcroster.com/keys with a 50-credit free trial, an active API subscription or purchased prepaid credits. The one-time trial requires a verified email and is subject to availability and abuse limits. Prepaid access has no monthly subscription requirement. |
| brand | full | Every endpoint, including writes (briefs, campaigns, contracts, messages, payouts, webhooks). Unmetered. Included with any Roster brand plan; created in the brand portal under Settings → API & Integrations. |
A data key calling anything outside its scope gets 403 with code BRAND_KEY_REQUIRED. There is nothing to configure: scope follows the key type.
Rotation and revocation
Keys never expire on their own. Revoke and re-mint from the same page that created them; revocation is immediate (validation checks the stored hash and the revoked flag on every request). Up to 5 active data keys per account, so you can cut over with zero downtime: mint the new key, deploy, revoke the old one.
Storage rules
The raw key is returned once, at creation, and never again: only a SHA-256 hash is stored. If you lose a key, revoke it and mint another. Treat keys like passwords: environment variables or a secret manager, never client-side code, never a repository.
What happens if my subscription lapses?
Purchased credits remain usable after a subscription ends. Prepaid access uses the remaining purchased balance at 60 requests/minute; it does not renew a monthly allowance. Once credits run out, metered requests stop until you manually fund the account. Revoked or unknown keys still return 401 INVALID_API_KEY.