Authentication Overview

UGC supports multiple authentication methods depending on your use case and the API endpoints you need to access.

Authentication Methods

1. API Key Authentication (Server API)

Use Case: Server-side integrations, campaign management, funding, webhook management

API keys are the most common authentication method for server-side integrations. Every key issued is a live key, active immediately:

• Your API Key: UGSK_live_xxx - For server-side calls only (never expose client-side)

Best For:

• Creating and funding campaigns
• Listing creator slots
• Configuring webhooks
• Accessing campaign analytics

2. Browser sign-in (operators)

Team members sign in at https://ugc.africa to manage campaigns, keys, and webhooks. That browser session is separate from your `UGSK_` API Key used on your servers-see Portal authentication for how the pieces fit together.

3. Public checkout links

Advertisers who don't hold an account of their own can still fund a campaign via a PaymentLink URL your server generates (POST /automation/actions/campaigns/:id/fund with method: "payment_link"). No separate buyer-side auth flow exists - the link itself is the credential.

4. Public Endpoints (No Authentication)

Use Case: Publicly accessible information

Some endpoints don't require any authentication, such as:

• Public campaign discovery listings
• Checkout/payment-link status pages
• Health checks

Security Best Practices

⚠ Critical Security Rules

• Never expose secret API keys in client-side code
• Always use HTTPS in production
• Implement webhook signature verification to prevent spoofing
• Rotate API keys regularly (every 90 days recommended)
• Use environment variables for all credentials
• Never commit credentials to version control

Recommended Practices

// Bad – key in source
const apiKey = 'UGSK_live_abc123...';

// Good – load from the environment (or a secrets manager)
const apiKey = process.env.UGSK_LIVE;

Quick Start by Use Case

Server-side campaign management

Use your API Key (UGSK_live_xxx) on your server only - keys are live from creation, so start with a small-budget real campaign to validate your integration. Language SDKs are on the roadmap-call the REST API today with fetch, axios, or your stack's HTTP client (same pattern as Getting Started):

const res = await fetch('https://api.ugc.africa/automation/actions/campaigns', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.UGSK_LIVE}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    title: 'Promote Zest App',
    payoutType: 'CPM_SOCIAL',
    advertiserCpmRate: 1.5,
    totalBudget: 200,
    targetPlatforms: ['tiktok', 'whatsapp_status'],
  }),
});
const json = await res.json();
// json.data is the DRAFT campaign - fund it next via POST /automation/actions/campaigns/:id/fund

→ API Key Authentication

Business operators (browser)

Team members sign in at https://ugc.africa and use the dashboard plus [Developer Console](https://developer.ugc.africa) for keys, webhooks, and configuration. That browser session works alongside your `UGSK_` API Key on your servers-see Portal authentication for the full picture.

→ Developer Console