How to connect properly to Elasticsearch cloud using API key and python lib?

Created API key under Elastic cloud (hosted on aws).

Doc declare a proper auth header should be attached:

Authorization: ApiKey $EC_API_KEY

Using curl it works:

curl -i -H "authorization: ApiKey LONG_KEY_STRING=="  https://12345.us-east-2.aws.elastic-cloud.com:9243/_health

HTTP/2 200 
x-cloud-request-id: 1234abc
content-type: text/plain; charset=utf-8
content-length: 34
date: Thu, 22 Oct 2020 12:36:54 GMT

{
  "ok": true,
  "status": 200
}

But the following python code (elasticsearch-7.9.1) fail:

es = Elasticsearch(['https://12345.us-east-2.aws.elastic-cloud.com:9243'], api_key="LONG_KEY_STRING==")
print(es.cluster.health())

With error:

{
    "errorMessage": "AuthenticationException(401, 'security_exception', 'missing authentication credentials for REST request [/_cluster/health]')",
    "stackTrace": [
        "  File \"/path/venv/lib64/python3.7/site-packages/lambda_local/main.py\", line 153, in execute\n    result = func(event, context._activate())\n",
        "  File \"main.py\", line 35, in handler\n    post_ping_doc(ping, msg[KEY_ID])\n",
        "  File \"main.py\", line 45, in post_ping_doc\n    print(es.cluster.health())\n",
        "  File \"/path/elasticsearch/client/utils.py\", line 152, in _wrapped\n    return func(*args, params=params, headers=headers, **kwargs)\n",
        "  File \"/path/elasticsearch/client/cluster.py\", line 69, in health\n    headers=headers,\n",
        "  File \"/path/elasticsearch/transport.py\", line 392, in perform_request\n    raise e\n",
        "  File \"/path/elasticsearch/transport.py\", line 365, in perform_request\n    timeout=timeout,\n",
        "  File \"/path/elasticsearch/connection/http_urllib3.py\", line 269, in perform_request\n    self._raise_error(response.status, raw_data)\n",
        "  File \"/path/elasticsearch/connection/base.py\", line 301, in _raise_error\n    status_code, error_message, additional_info\n"
    ],
    "errorType": "AuthenticationException"
}

Tried other variations while browsing the net, all with the same result.

Fired up a local ncat -l 1234 and redirected the request to it. request seems legit...

GET / HTTP/1.1
Host: 127.0.0.1:1234
Accept-Encoding: identity
connection: keep-alive
content-type: application/json
user-agent: elasticsearch-py/7.9.1 (Python 3.7.5)
authorization: ApiKey LONG_KEY_STRING==

Python code does work with local unsecured ES on docker (not requiring any key).

Currently out of idea, any help is appreciated.