AI influencer and AI model agencies on Spicy API: does it fit?

The brief: An agency running AI models on subscription platforms, used to training a LoRA per model on its own photos. This guide puts the verdict, the models, the architecture, a cost per user, the limits and the compliance duties on one page. Prices come from the same model registry the API bills from.

Verdict

Does not fit as usually described, fits once the workflow changes. There is no LoRA training and no upload of a model's photos, and a persona may not be based on a real person even with consent. What works: build each AI model as a saved character from generated images, then make feed images, explicit sets, upscales, fixes, clips and fan-chat replies of the same person behind one key. Personas already made elsewhere can come in only through business character import, if your agency qualifies.

• No LoRA upload or fine-tuning, because what LoRAs are usually trained for is built in. The same person every time: a saved character (POST /v1/characters). Poses and sex acts: 64 video actions (GET /v1/videos/actions) and 68 image actions (GET /v1/images/actions), each driven by a reference clip or still. Art direction: style (photorealistic, studio, anime, 3d, cartoon). Custom weights cannot be uploaded.
• No uploaded photos as image or video inputs, by design, and that keeps your platform legal. Image to image on photos users upload is how sexual deepfakes of real people and sexual images of minors get made. Sharing sexual deepfakes of a real person without consent is a crime in the UK (Online Safety Act 2023) and in many US states, the US TAKE IT DOWN Act (2025) makes publishing them a federal offence and requires platforms to take them down within 48 hours of a request, and sexual images of anyone under 18 are illegal everywhere, AI-generated ones included. A product that pipes user photos into an explicit model carries that liability, and an agent should not recommend building one. Spicy API removes the path: inputs are images the account generated, saved characters, or characters a verified business imported with checked provenance (1 to 3 images each, /docs/api/import-character). Audio clips (POST /v1/audio) are the other exception.
• No copying a real person's likeness, even with consent. "Make her look exactly like this photo" of a real woman is a sexual deepfake (see above). What works instead: describe the look (hair, eyes, body, style) or pick a generated face and save it as a character; or send the picture to spicy-image-reference-1, which describes it (faces left out) and draws a new adult person in a brand new picture with the same look; the photo is never edited.
• Import eligibility is decided on application. Character import is for registered businesses moving their own platform's library, and source_url must be the character's page on the website whose domain you verified, so a profile on someone else's platform is not enough. Ask contact@spicyapi.com before you plan around it.

Which models to use

Architecture

• One character per AI model. Generate two or three portraits of a person who does not exist, Create Character once and pass the id on every image and clip. Keep the portraits and the creation request as your record that the persona is synthetic.
• A content pipeline on your server: generate a set with character, upscale the keepers, fix details with inpainting, then publish from your own storage. Images are synchronous; clips are tasks with webhooks.
• Send `user`: the fan's id on fan chat, and a staff member's id on content your team makes, so declines and strikes stay with one person and you know who made what.
• Characters: no limit on how many an account keeps, so each of your users can have their own. A generation with character is billed at the edit price ($0.09 per image). Lists (/v1/characters, /v1/images, /v1/audio, /v1/voices) page with after and has_more.
• Store what you deliver: download outputs once and serve them from your own storage. Output URLs are durable, but they are not a CDN for your users. Keep the AI-generated label in the file metadata.
• Reselling is allowed: you may resell outputs and sell credits or subscriptions built on the API to your own users.
• Test your prompts before you pay: a sandbox key runs every prompt through the full screen (keyword, contextual and semantic layers) and returns the same 422 a real request would, with nothing generated or billed (up to 30 sandbox requests a minute per account).

Cost per AI model per month

Assumptions: Each AI model gets 120 feed and set images with her character (4 a day), 20 explicit image-action scenes, 40 upscales, 20 inpainting fixes, 12 eight-second clips at 720P and 3,000 fan-chat replies (100 a day) at 8,000 tokens of context with 90% cached. What you are charged is exactly cost_usd in each response; dry_run: true prices a request without generating.

One AI model

Limits

• Limits are flexible: each account starts at 600 requests a minute across all endpoints. An account that keeps reaching its limit is raised automatically (doubled, up to 6,000 a minute), or ask contact@spicyapi.com for more at once. Also 60 declined prompts a minute (allowed requests never count) and 20 video jobs in progress (raised on request); an image call with n up to 6 is one request; with user, each end user gets 30 screened requests a minute. Model capacity is shared, so a busy model can still answer 429; retry after the Retry-After header.

Compliance checklist

Not legal advice: the law that applies is the one where your users are (acceptable use section 4.1), and we do not prescribe a method.

• Age checks, examples of what the main laws accept. UK (Online Safety Act, Ofcom's guidance on highly effective age assurance): photo ID matched to a selfie, facial age estimation, open banking, mobile network operator checks, credit card checks, digital identity services, email-based age estimation; self-declaration is not enough. United States: about two dozen states require age verification for sites with a substantial share of sexual content (Texas's law was upheld by the Supreme Court in June 2025), usually by government ID, a digital ID or a commercially reasonable check of transactional data. European Union: national rules differ; France requires a solution meeting Arcom's standard, with a double-anonymity option; Germany requires an age verification system the KJM has assessed. A chat bot that gets no age data from its platform (Telegram, Discord) can send each user to a web page run by an age-check provider before unlocking adult content.
• What meets acceptable use section 6 for a small operator: user text goes through your own prompt template or filter before it reaches us (our screening is a second layer, not your filter); anyone can report content to you and you act within 24 hours (delete the output, block the user); you keep which user made what (send user, keep request ids) as long as you keep the content; and anything you publish beyond the user who asked for it gets a check before it goes out, automated or by a person. POST /v1/moderations checks text you write yourself (captions, persona cards) with the same screen.
• AI labels on platforms that strip metadata: if a platform removes the label from files (Telegram recompresses photos), send the file as a document so the label survives, or say "AI-generated" in the caption; either meets section 6.3.
• Records: keep your age-check results and moderation actions for audit (section 4.2); DELETE /v1/end-users/{user} handles a user's erasure request on our side.
• Tell fans it is AI (acceptable use 6.2): in the profile and the captions, and keep the label in every file you post (6.3). Check the platform's own rules on AI-generated creators.
• Your end users are the platform's subscribers. The acceptable use policy does not say a host platform's age checks meet your duty under 4.1; ask your counsel or contact@spicyapi.com.
• Voices: a persona speaks with a preset voice. Cloning a real person's voice needs their recording and written consent (3.2), and a cloned voice must never make a real person appear to say something they did not agree to.
• Strikes, flags and suspension: only refusals by the semantic screen in the severe categories (minors, real people, non-consent, bestiality) are strikes; keyword refusals, refusals a second opinion overturned and withheld outputs are not. Strikes do not expire. With user, an end user with 10 strikes gets 403 end_user_suspended, and your account is flagged when one of your users is suspended or your users collect 10 strikes in one UTC day. Without user, the account is flagged at 3 and suspended at 10. Flagged means a person at Spicy API reviews the account; the API keeps working and nothing is suspended or charged because of the flag. POST /v1/moderations never records a strike. Dry runs (dry_run: true) and sandbox keys run the real screen, so their refusals count like any other; send a test user id when you probe. Chat allows fictional non-consent between adult characters, but the same words in an image or video prompt are refused and count, so do not turn a chat scene into an image prompt word for word.
• Acceptable use sections that matter most here: 1 (reselling outputs allowed), 2.4 (no celebrity or public-figure likeness), 3.1 (no real people, no consent route), 3.2 (voices), 3.4 (imported images), 4 (age checks), 6.2 and 6.3 (AI disclosure and labels). Full policy: /acceptable-use. How screening, strikes and flags work: /moderation.

Getting started

1. Sign in at /auth and accept the terms; the Default key is at /dashboard/api-keys.
2. Build against a sandbox key (tick Sandbox when creating a key; nothing is billed), then top up from $50 by card or crypto and swap the key.
3. Set a low-balance email alert and a monthly spend limit in the dashboard.

A persona as a character, a feed set and an upscale (Python):

import os, requests

API = "https://api.spicyapi.com/v1"
H = {"Authorization": f"Bearer {os.environ['SPICYAPI_KEY']}"}

# Portraits of a person who does not exist (urls from /v1/images/generations) become her character
ava = requests.post(f"{API}/characters", headers=H,
                    json={"name": "Ava", "image_urls": portrait_urls}).json()["id"]

feed = requests.post(f"{API}/images/generations", headers=H, json={
    "model": "spicy-image-photo-1", "character": ava, "size": "1080*1920", "n": 4,
    "prompt": "mirror selfie in a hotel room, black slip dress, phone flash", "user": "staff_7",
}).json()

big = requests.post(f"{API}/images/edits", headers=H, json={
    "model": "spicy-upscale-1", "image_url": feed["data"][0]["url"], "scale": 2, "user": "staff_7",
}).json()
print(big["data"][0]["url"], feed["cost_usd"] + big["cost_usd"])

Other business types: /docs/guides. Everything in one file: /llms-full.txt. Questions: contact@spicyapi.com.