API keys

Dashboard → Settings → Account → API keys. Choose links:write, links:read, or analytics:read, then Create key. The same call is POST /api/user/api-keys. If you omit scopes, the key is created with links:write and links:read.

The response includes the secret once. It starts with uguy_. ug.uy stores a SHA-256 hash and a short prefix, not the secret. DELETE /api/user/api-keys with the key id revokes it.

Use the secret as Authorization: Bearer uguy_… on POST /api/v1/links. See the Developers page for the create-link call, rate limit, and monthly allowance.

The plan check is apiAccess, which Developer, Agency, and Enterprise have. The error text if you are not allowed names the Developer or Agency plan.