API keys

Use API keys to authenticate server-side requests to Four Echelon. Keys are managed in the dashboard and should never be exposed in client-side code.

Server-side only

A key is a bearer credential for your account. Anything holding it can spend your budget, so it belongs in a secret manager and in server-side code — never in a browser bundle, a mobile binary, a prompt, or source control.

Managing keys

Mint and revoke keys from the dashboard. Revocation takes effect immediately. Use separate keys per environment so you can revoke one without taking everything down.

Keys require an active or trialing subscription
The secret is shown once, at creation
Revoked keys fail closed with 401 authentication_error

If a key leaks

Revoke it first, then mint a replacement. Do not wait to work out how far it spread — revocation is instant and free, and usage on a revoked key stops immediately.