> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudservices.ecowestern.net/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create and manage scoped ECS API keys from the dashboard

Create and manage API keys from the ECS dashboard. The dashboard is the supported way to create, scope, copy, deactivate, reactivate, and delete keys.

<CardGroup cols={3}>
  <Card title="Name it clearly" icon="tag">
    Use a name that identifies the application or automation job using the key.
  </Card>

  <Card title="Scope it narrowly" icon="shield-check">
    Select only the services, resources, and actions that integration needs.
  </Card>

  <Card title="Protect the secret" icon="lock-keyhole">
    Copy the key once, store it securely, and never share it publicly.
  </Card>
</CardGroup>

## Create a key

1. Sign in at [cloudservices.ecowestern.net](https://cloudservices.ecowestern.net).
2. Open the **Dashboard**.
3. Open **API Keys**.
4. Select **Create New Key**.
5. Give the key a descriptive name.
6. Select the services and resources it can access.
7. Select the actions it can perform.
8. Set an expiration date if needed.
9. Create the key and copy the full secret.

The full secret is shown only once. Store it securely before leaving the page.

## Choose permissions

Use the smallest scope that fits the application. For example:

* A deployment tool may need `canopy:write` and `canopy:read`.
* A monitoring tool may need `flow:read` only.
* An application that sends requests to a function needs `flow:invoke`.
* A storage cleanup tool may need `clearlake:delete`.

See [Permissions](/guides/permissions) for the complete action and resource model.

## Manage existing keys

From **Dashboard → API Keys**, you can:

* View key names, prefixes, status, expiration, and last-used time.
* Update a key's name or expiration.
* Add or remove permission rules.
* Deactivate or reactivate a key.
* Permanently delete a key.

The dashboard never displays the full secret after the key is created. If a key is lost, create a replacement.

## Permission planning

Start with the narrowest useful key and add access only when the integration needs it.

| Integration          | Suggested access                         |
| -------------------- | ---------------------------------------- |
| Function caller      | `flow:invoke` on the required function   |
| Function monitor     | `flow:read` on the required function     |
| Static-site deployer | `canopy:read`, `canopy:write`            |
| Object uploader      | `clearlake:write` on the required bucket |
| Object browser       | `clearlake:read` on the required bucket  |
| Domain automation    | `waymark:read`, `waymark:write`          |

Avoid using `*` for production integrations unless the integration genuinely manages every resource in the account.

## Rotation workflow

1. Create a replacement key with the same or narrower permissions.
2. Deploy the replacement to the integration.
3. Confirm that requests succeed with the replacement.
4. Deactivate the old key.
5. Delete the old key after the transition is complete.

This keeps the old credential available during a controlled cutover without leaving it active indefinitely.