API keys

You need an API key to call any endpoint at https://api.ecohash.com. Keys are scoped to your account — every call made with a key bills against your account's credit balance.

Create a key

1. In the console, go to API Keys in the sidebar.

2. Click Create new key.

3. Give it a name (e.g. "local dev", "production backend", "data pipeline") and optionally a source tag for billing analytics.

4. Optionally set an expiration date — after that date the key stops working automatically (see Expiration). Leave it blank for a key that never expires.

5. Choose the key's Compute access:

   • Off (the default) — the key calls models only.
   • Read-only — the key can also list your GPU instances, clusters, storage and templates, and quote prices, but cannot launch, change or delete anything. A good choice for an AI agent that should look before it asks you to act.
   • Full — the key can also launch and manage GPU instances, clusters, cloud drives and shared filesystems, billed to your account exactly as in the console (see Compute API overview).

   Access is fixed when the key is created; to change it, create a new key. The key list shows each key's access as Models, Compute (read) or Compute.

6. Click Create.

7. Copy the key immediately. It starts with eco_ and is shown only once. If you lose it, you'll need to revoke it and create a new one.

Use a key

Pass the key in the Authorization header as a bearer token:

curl https://api.ecohash.com/v1/chat/completions \
  -H "Authorization: Bearer eco_YOUR_KEY_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "llama-3.1-8b-instruct",
    "messages": [{"role": "user", "content": "Say hello"}]
  }'

The same key works for every model endpoint: /v1/chat/completions, /v1/embeddings, /v1/images/generations, /v1/audio/speech, /v1/audio/transcriptions, /v1/video/generations, /v1/rerank. The GPU endpoints (/gpu-instances, /gpu-clusters, /cloud-drives, …) additionally need a key with Compute access — Read-only to list and quote, Full to launch and manage. See Compute API overview.

Use a key with OpenAI SDKs

Since the API is OpenAI-compatible, point any OpenAI SDK at EcoLink by changing the base URL:

from openai import OpenAI
client = OpenAI(
    api_key="eco_YOUR_KEY_HERE",
    base_url="https://api.ecohash.com/v1",
)
resp = client.chat.completions.create(
    model="llama-3.1-8b-instruct",
    messages=[{"role": "user", "content": "Say hello"}],
)
print(resp.choices[0].message.content)

import OpenAI from "openai";
const client = new OpenAI({
  apiKey: "eco_YOUR_KEY_HERE",
  baseURL: "https://api.ecohash.com/v1",
});
const resp = await client.chat.completions.create({
  model: "llama-3.1-8b-instruct",
  messages: [{ role: "user", content: "Say hello" }],
});
console.log(resp.choices[0].message.content);

Revoke a key

1. API Keys in the sidebar.
2. Click Revoke next to the key.
3. Confirm.

A revoked key stops working immediately. Existing in-flight requests using that key finish; new requests get a 401 Unauthorized.

Connected apps

Apps you connect by signing in with your EcoHash account — for example an MCP client using the GPU MCP server — appear under API Keys → Connected apps, with the access you granted and when each was last used. They use your account the way an API key does, with the permissions you chose when you approved them.

Click Disconnect to remove one. It loses access on its very next request; to use it again, connect it again from the app.

Expiration

A key can carry an optional expiration date, set when you create it. Once that date passes, the key stops working on its own — calls made with it return 401 Unauthorized, exactly as if it had been revoked. This is useful for time-boxed access (a contractor, a demo, a temporary integration) where you'd rather not rely on remembering to revoke it.

• Leave expiration blank for a key with no expiry.
• An expired key can't be "renewed" — create a new key and update your integration.
• Expiration is independent of revoking: you can still revoke a key manually before its expiry.

Good practices

• One key per environment or service. If something leaks, revoke just that key without breaking other services.
• Store keys in a secrets manager, not in source control. Set them as environment variables at runtime.
• Rotate keys at least yearly — or whenever anyone who had access to the key leaves the team. For time-boxed access, set an expiration date so the key retires itself.
• Use source tags in key creation to segment billing (Billing → Usage filters by source tag).

Multiple users, shared keys

Every key belongs to the account it was created in — it spends that account's balance — and to the user who created it. Each person on a team creates their own keys, and what a key does is attributed to its creator.

• Members see and revoke only their own keys.
• Owners and admins see every key on the account. Only an owner can revoke someone else's key.
• Removing a user from the account revokes their keys and disconnects their connected apps.

See Team & invites for the access model.