> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudservices.ecowestern.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests with an ECS API key

Use an ECS API key for Flow, Canopy, ClearLake, and Waymark requests:

```http theme={"theme":{"light":"github-light","dark":"github-dark"}}
Authorization: Bearer ecs_<8-character-prefix>_<32-character-secret>
```

Create your key from the ECS dashboard:

1. Sign in at [cloudservices.ecowestern.net](https://cloudservices.ecowestern.net).
2. Open the **Dashboard**.
3. Open **API Keys**.
4. Select **Create New Key**.
5. Choose the services, resources, actions, and expiration for the key.
6. Create the key and copy the secret.

The full secret is shown only once. If you lose it, deactivate that key and create a replacement.

## Example

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl https://api.cloudservices.ecowestern.net/v1/clearlake/buckets \
  -H "Authorization: Bearer $ECS_API_KEY"
```

## Keep credentials safe

* Store the key in a secret manager or server-side configuration.
* Never commit it to source control.
* Never put it in URLs, browser bundles, logs, or analytics events.
* Create separate keys for separate applications.
* Grant only the services and actions each application needs.
* Deactivate a compromised key immediately.

The account associated with your key is selected automatically. Service requests do not accept an `account_id` selector.