API access | Ecocloud

DevelopersPractical guide4 steps

In this guide

Before you start

Create an API key in your account and set the example environment variables locally. Keep the key out of source control and shared terminal output.

Step-by-step workflow

Create a dedicated key
Use the account's API-key controls and keep the credential in your local secret store. Revoke it when the integration is retired.
Make a supported read
Use the Bearer authorization header and a documented read endpoint. The example below reads services associated with the account.
Handle the response
Check the HTTP status before consuming the body. Handle authentication errors separately from connectivity or service errors.
Keep writes in the supported workflow
Use the authenticated console for changes. Read-only API access is not an alternative credential for write operations.

API keys

Create and manage API keys through the authenticated console. Treat a key as a secret and revoke it when it is no longer needed. Customer API keys provide read-only access on supported endpoints; they are not unrestricted infrastructure administration credentials.

Read your resources

The following example uses environment variables for your platform origin and API key. Set them in your own environment; never place a real key in public source code.

curl --fail-with-body \
  -H "Authorization: Bearer $ECOCLOUD_API_KEY" \
  "$ECOCLOUD_ORIGIN/api/v1/services"

Supported API-key reads

GET /api/v1/me — account information
GET /api/v1/services — service resources
GET /api/v1/invoices — invoice information

Writes follow authenticated console workflows and their applicable authorization requirements. Check the actual response shape and error status rather than assuming all endpoints share a payload format.

Check your result

A supported read returns information for your authenticated account. Inspect the HTTP status and actual response before building a consumer around it.

If something does not work

For an authentication error, check the platform origin and whether the key is still valid. For an authorization error, confirm that the operation supports API-key reads. Do not retry a write with a read-only key.

The response is unauthorized: Confirm the platform origin and that the API key is valid. Do not include the key in support requests or logs.
A write request is rejected: Customer API keys support documented reads. Perform the change through the authenticated console and its confirmation flow.