Authentication

EggAPI has two authentication modes:

• Server-to-server API calls and MCP clients use API keys.
• The website dashboard, playground, and admin tools use browser session cookies.

This documentation covers the API key flow.

API Key Header

Send your key as a Bearer token on every request:

Authorization: Bearer YOUR_API_KEY

Example:

curl https://api.eggapi.ai/v1/usage/summary \
  -H "Authorization: Bearer YOUR_API_KEY"

The backend rejects the request when the header is missing, the format is not Bearer <token>, the key is unknown, inactive, or expired, or the owning account is suspended.

Creating Keys

Create, rename, disable, and delete API keys from the EggAPI dashboard. Key management is a dashboard session action and is not available with an API key.

The full key is shown when it is created. Store it immediately, treat it like a password, and only use it from server-side code.

Endpoints That Accept API Keys

API key requests are rate limited per key. When the limit is exceeded the API returns 429 RATE_LIMITED; back off and retry.

Security Practices

• Keep API keys on your server. Do not expose them in frontend JavaScript, mobile apps, public repositories, or logs.
• Use separate keys for production, staging, local development, and AI agents, so you can disable one without touching the others.
• Rotate a key if it may have been exposed.
• When browser users need to trigger generation, call EggAPI from a backend endpoint you control.

Common Authentication Errors

{
  "data": null,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing Authorization header"
  }
}

{
  "data": null,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid Authorization format, expected 'Bearer <token>'"
  }
}

{
  "data": null,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "API key has expired"
  }
}

{
  "data": null,
  "error": {
    "code": "FORBIDDEN",
    "message": "User account is suspended"
  }
}