API Keys

API keys let you access the U-Gen API programmatically. Each key is scoped to your account and shares your prepaid credit balance.

Keep Your Keys Secret

API keys grant full access to your account's credits and data. Never expose them in client-side code, public repositories, or logs. If a key is compromised, revoke it immediately from the dashboard.

Creating an API key

Open the API Keys page

Click "Create New Key"

Give your key a descriptive name (e.g., "Production Backend" or "Staging Test"). This helps you identify keys later.

Copy your key immediately

The full API key is shown only once. Copy it and store it securely. You cannot retrieve it later — only revoke and create a new one.

Set environment variable

Store the key as UGEN_API_KEY in your .env file or secrets manager. Never commit API keys to version control.

Using your API key

Include your API key in the X-API-Key header with every request:

Test your key

curl -X GET https://api.u-gen.ai/api/v1/credits/balance \
  -H "X-API-Key: YOUR_API_KEY"

Dual Authentication

U-Gen supports two authentication methods: JWT tokens (from Supabase Auth, used by the web app) and API keys (for server-to-server integration). Both provide the same access level. See the API Reference for full details.

Managing keys

View keys

API Keys page shows name, created date, last used, and a masked key prefix.

Revoke a key

Click the trash icon next to any key. This is immediate and irreversible — any system using that key will stop working.

Rotate a key

Create a new key, update your systems to use it, then revoke the old key.

Key properties

Each API key stores the following fields:

Field	Description
`name`	Human-readable label you chose when creating the key.
`key_prefix`	Masked prefix shown in the dashboard (e.g., ugen_sk_...Ab4c).
`last_used_at`	Timestamp of the last API request made with this key.
`expires_at`	Optional expiration date. Null means the key never expires.
`created_at`	When the key was generated.

Job limits

Your account has limits on concurrent and daily video generation jobs. These limits are tied to your account and apply across all your API keys. If you exceed them, the API returns a 429 error with a retry_after value.

Best Practices

Use separate API keys for each environment (dev, staging, production). This makes it easy to rotate keys without downtime and helps you track usage per environment.