Authentication
ContentHub uses scoped API keys for REST API authentication. All keys are workspace-scoped — a key generated in Workspace A can never access data in Workspace B.
Bearer token format
Pass your API key as a Bearer token in every request header:
Authorization: Bearer uch_live_a1b2c3d4e5f6...All ContentHub API keys use the prefix uch_live_ followed by 48 hex characters (24 random bytes = 192 bits of entropy). This prefix makes keys immediately recognizable in logs, environment files, and secret scanning tools.
Generating API keys
Only workspace members with the CLIENT_ADMIN role (or platform superadmins) can generate API keys. Keys are managed at:
Dashboard → Settings → API Keys
When you create a key, the full plaintext is shown exactly once. ContentHub stores only a SHA-256 hash — it cannot be retrieved later. Copy it to a secure location immediately.
Scopes
Each API key is granted one or more scopes at creation time. A request to an endpoint that requires a scope not included in the key returns 403 INSUFFICIENT_SCOPE. Follow the principle of least privilege — only grant scopes the integration actually needs.
| Scope | What it allows |
|---|---|
| content:read | List and retrieve content items (title, status, metadata, full body) |
| content:write | Create new content drafts and update existing content body, title, and status |
| content:generate | Trigger AI content generation jobs (counts against monthly quota) |
| content:publish | Trigger immediate or scheduled publishing to connected platforms |
| products:read | List and retrieve products from the workspace catalog |
| products:write | Create new products and update existing product details, price, and status |
| projects:read | List and retrieve project metadata (platform type, language, active status) |
| kb:read | List knowledge base sources and their processing status |
| kb:write | Add new knowledge base sources (text, URL) to a project |
| slots:read | List publish slot schedules and their upcoming occurrences |
| slots:write | Create, update, and delete recurring publish slot schedules |
| media:read | List gallery images, read image details, and check storage usage |
| media:write | Upload images (base64 or remote URL), import product images, edit SEO attributes, and delete |
Recommended scope sets by integration type
products:readprojects:readproducts:readproducts:writecontent:readcontent:writecontent:generatecontent:publishcontent:readproducts:readprojects:readKey expiry
You can optionally set an expiry date when creating a key. After that date, the key returns 401 KEY_EXPIRED. If no expiry is set, the key remains valid until manually revoked. We recommend setting expiry dates for keys used in temporary integrations or one-off automations.
Revoking keys
Keys can be revoked instantly from Settings → API Keys. Revocation takes effect immediately — the next request with that key returns 401 KEY_REVOKED. Revoking a key does not affect data created with that key.
Key rotation
We recommend rotating API keys periodically or whenever a team member who had access to the key leaves your organization. The rotation process is:
- Create a new key with the same scopes as the old one
- Update your integration to use the new key
- Verify the integration works correctly
- Revoke the old key from the dashboard
There is no downtime during rotation — both keys are valid until the old one is revoked.
Security notes
- Never commit API keys to source control — use environment variables
- Keys are workspace-scoped: they can only access data in the workspace they were created in
- ContentHub only stores a SHA-256 hash of your key — the plaintext cannot be recovered if lost
- All REST API calls are logged in your workspace Audit Log
- Use
last usedtimestamps in Settings → API Keys to detect unused keys and revoke them
Next steps
- API Reference — explore all available endpoints
- Rate Limits — plan quotas and 429 handling