API keys

Create and manage API keys from the ECS dashboard. The dashboard is the supported way to create, scope, copy, deactivate, reactivate, and delete keys.

​

Create a key

1. Sign in at cloudservices.ecowestern.net.
2. Open the Dashboard.
3. Open API Keys.
4. Select Create New Key.
5. Give the key a descriptive name.
6. Select the services and resources it can access.
7. Select the actions it can perform.
8. Set an expiration date if needed.
9. Create the key and copy the full secret.

The full secret is shown only once. Store it securely before leaving the page.

​

Choose permissions

Use the smallest scope that fits the application. For example:

• A deployment tool may need canopy:write and canopy:read.
• A monitoring tool may need flow:read only.
• An application that sends requests to a function needs flow:invoke.
• A storage cleanup tool may need clearlake:delete.

See Permissions for the complete action and resource model.

​

Manage existing keys

From Dashboard → API Keys, you can:

• View key names, prefixes, status, expiration, and last-used time.
• Update a key’s name or expiration.
• Add or remove permission rules.
• Deactivate or reactivate a key.
• Permanently delete a key.

The dashboard never displays the full secret after the key is created. If a key is lost, create a replacement.

​

Permission planning

Start with the narrowest useful key and add access only when the integration needs it. Avoid using * for production integrations unless the integration genuinely manages every resource in the account.

​

Rotation workflow

1. Create a replacement key with the same or narrower permissions.
2. Deploy the replacement to the integration.
3. Confirm that requests succeed with the replacement.
4. Deactivate the old key.
5. Delete the old key after the transition is complete.

This keeps the old credential available during a controlled cutover without leaving it active indefinitely.