Identity as a Service:Integration guide for IDaaS M2M and AI Gateway

Create an Internet NAT gateway

1. Go to the Internet NAT Gateway purchase page, set the following configurations, and then click Buy Now. For more information, see Create an Internet NAT gateway and associate an EIP.

   Parameter	Description	Example
   Billing Method	Only Pay-As-You-Go is supported.	Pay-As-You-Go
   Region	Select the region where you want to create the Internet NAT gateway.	Singapore
   Network and Zone	Select the VPC and vSwitch for the Internet NAT gateway. You cannot change these settings after the gateway is created.	TEST_VPC
   EIP	Select an option based on whether you have created an EIP.	Purchase EIP

2. Log on to the VPC console and switch to the destination region in the top navigation bar. In the navigation pane on the left, choose NAT Gateway > Internet NAT Gateway.

3. Find the target instance and click its instance ID to open the details page.

4. On the SNAT tab, click Create SNAT Entry.

5. On the Create SNAT Entry page, set SNAT Entry to Specify VPC and EIP to the associated EIP. Then, click OK.

Create an AI Gateway instance

1. Go to the AI Gateway purchase page, enter the required configurations, and then click Buy Now.

   Note

   The following configurations are for creating an instance that has its Network Type set to Public Network and uses the minimum Instance Specification. Keep the default values for any other configurations. For more information, see Create a gateway instance.

   Parameter	Description	Example
   Product Type	Supports Dedicated Instance (pay-as-you-go), Dedicated Instance (subscription), and Serverless (Pay-as-you-go).	Dedicated Instance (pay-as-you-go)
   Region	Select the destination region. Note Select the same region as the Internet NAT gateway instance created in the previous step.	Singapore
   Instance Name	Enter a custom name for the gateway.	test_gateway
   Instance Specification	Select the node specifications as needed. The Serverless version does not have gateway specifications.	aigw.small.x1
   Network Type	Supports Public Network, Private Network, and Public + Private access types.	Public Network
   Private Network	Select the VPC where the gateway instance runs. Note Select the same VPC as the Internet NAT gateway instance created in the previous step.	TEST_VPC
   Select Zone	Select Auto-assign or Manually Select. Auto-assign: Select a vSwitch. The system automatically allocates two zones to deploy the gateway nodes. Manually Select: Manually select the zones and vSwitches to deploy the gateway nodes.	Auto-assign
   vSwitch	Select the vSwitch where the gateway instance runs.	VSW_1
   Service-linked Role	Click Create Service-linked Role for all items to create the following two roles. For more information, see Service-linked Role. AliyunServiceRoleForNativeApiGw AliyunServiceRoleForNativeApiGwInvokeFC	-

2. On the Confirm Order page, review the AI Gateway configuration details and click Buy Now.

3. Return to the AI Gateway Instance page. The gateway creation is complete when its Status changes to Running (this may take 1 to 5 minutes).

Create an AI Gateway service

1. Log on to the AI Gateway console and switch to the destination region in the top navigation bar. In the navigation pane on the left, choose AI Gateway > Instance.

2. Find the target instance. Click the instance ID to open the details page.

3. In the navigation pane on the left, click Service and then click Create Service. If the Configure Default Alerts panel appears, you can configure the settings as required or skip this step.

4. In the Create Service panel, configure the following parameters and click OK.

   Note

   The following example shows the configurations for Alibaba Cloud Model Studio. Keep the default values for any other configurations. For more information, see Create a service.

   Parameter	Description	Example
   Service Source	Select the type of service to be accessed through the proxy.	AI Services
   Service Name	Enter a custom service name.	test_bailian
   Large Model Supplier	Select the large model provider to be accessed through the proxy.	Alibaba Cloud Model Studio
   Model Protocol	Specify the model protocol. Keep the default value.	OpenAI/v1
   Service URL (base_url)	Set the endpoint provided by the large model provider. Keep the default value.	https://dashscope.aliyuncs.com/compatible-mode/v1
   Generation Method	Specify how to generate the key required to access the large model.	Enter
   API-KEY	Set the credential required to access the large model.	sk-4901******8a59

Create a Model API

1. On the AI Gateway instance details page, in the left navigation pane, click Model API and then click Create Model API.

2. Select a scenario and click its Create button. In the panel that appears, provide the following information and click OK.

   Note

   The following configurations are for the Text Generation scenario. Keep the default values for any unmentioned configurations. For more information, see Manage Model APIs.

   Parameter	Description	Example
   Protocol	Different protocols correspond to a set of built-in default routing rules for the scenario. These are used to quickly generate compatible interfaces for services such as OpenAI, DashScope, and vLLM.	OpenAI-compatible
   API Name	Enter a custom API name. The name must be globally unique within your account.	test_api
   Domain Name	The domain name used to access this API. You can select multiple domain names. The combination of the domain name and the BasePath must be unique. To add a new domain name, click Add Domain Name on the right to create a domain name. Note If you set Network Type to "Public Network" or "Public + Private" when creating the AI Gateway instance, or if you configured a public domain name after creating the instance, the instance can be accessed through the public domain name. The public domain name provided by AI Gateway has a daily call limit of 1,000. It is for testing only and must not be used in a production environment. To call the AI Gateway using a specific domain name in a production environment, create a CNAME record to resolve this domain name to the public domain name of the current AI Gateway instance. You can find the public domain name on the Overview > Endpoint > Access Domain Name and IP Address page of the AI Gateway instance.	example.aliyun.com
   Service Type	Supports Single Service, Multiple Service (by model name), and Multiple Services (by proportion).	Single Service
   Service Name	Select the target service.	test_bailian

3. On the API details page, click the Consumer Authentication tab. Click Configurations > Edit. In the panel that appears, turn on the Status switch, set Authentication Method to JWT, and click OK.

Create an IDaaS instance

1. Log on to the IDaaS console and switch to the destination region in the top navigation bar. In the navigation pane, select EIAM.

2. On the right side of the page, click IDaaS > Create Instance. In the panel that appears, set the Description, select Alibaba Cloud Product Service Agreement, and click Create.

3. In the EIAM instance list, find the target instance and click Manage in the Actions column to open its management backend.

4. In the navigation pane on the left of the EIAM instance management backend, choose Application Management > M2M Applications. In the Note on Upgrade dialog box, click Upgrade Now.

5. On the upgrade page, enable M2M Management, configure other options as needed, and click Buy Now.

Create an M2M client application

1. In the navigation pane on the left of the EIAM instance management backend, choose Application Management > M2M Applications.

2. Click Add Application, set Application Name to "M2M Client", and click Add to open the application details page.

3. On the General tab, click Credential Management > Client Secret Credential > Add client_secret. Select a Client Secret Validity Period and click Confirm.

4. Click View next to client_secret. Copy and save the client_id and client_secret values for later use.

5. Copy and save the URL from Application Settings > Token Endpoint for later use.

6. On the Client Permission Management tab, turn on the Custom Permissions switch.

Create an M2M server application

1. In the navigation pane on the left of the EIAM instance management backend, choose Application Management > M2M Applications.

2. Click Add Application, set the Application Name to "M2M Server", and click Add to open the application details page.

3. On the Server Permission Control tab, under Authorized application, turn on the Server Permission Control switch. In the panel that appears, set the ResourceServer Identifier and click Confirm.

   Note

   Set ResourceServer Identifier to cloud:idaas:aigateway:alibabacloud:<account-id>, where <account-id> is your Alibaba Cloud account ID.

4. Under Permission Management, click Create Scope. Enter a Scope Name and a Scope Value, and click Confirm.

5. Under Authorized Applications, turn on the switch for M2M Client. Then, select the permission you added in the previous step from the Permission list and click Confirm.

6. On the General tab, go to Application Settings > Public Key Endpoint. Copy and save the URL for later use.

Create a consumer and configure JWT authentication

1. Log on to the AI Gateway console and select the destination region from the top menu bar. In the navigation pane on the left, click AI Gateway > Consumers.

2. On the Consumers page, click Create Consumer in the upper-left corner.

3. On the Create Consumer page, enter the required information and click Create. For more information, see Create a consumer.

   Parameter	Description	Example
   Consumer Name	Enter a custom name for the consumer.	test_consumer
   Status	The consumer status can be Enable or Disable. You can manually enable or disable the consumer after it is created.	Enable
   Authentication Method	Set the authentication method for the consumer: API Key, JWT, or HMAC. This example uses JWT. Creation Method: Remote Fetch. JWKS: Set this to the Signature Verification Public Key Endpoint URL from the Create an M2M server application step. Consumer Identity in JWKS Payload: Key: scope. Value: Set this to the Permission ID from the Create an M2M server application step. Configure other settings as needed or keep the default values.	JWT

Authorize the API for the consumer

1. On the Consumers page, click a consumer. On the details page, click the Consumer Authorization tab.

2. On the Model API tab, click Authorization.

3. In the authorization panel, select the Model API created in the previous steps and click OK. For more information, see Authorization management.

Get an M2M token

In a terminal that can access the public network, run the following curl command to obtain an Access Token using the client_secret_post method.

curl --location --request POST '<Token endpoint of the M2M client application, for example: https://******.aliyunidaas.com/api/v2/iauths_system/oauth2/token>' \
     --header 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'grant_type=client_credentials' \
     --data-urlencode 'client_id=<client_id of the M2M client application, for example: app_m5doo******>' \
     --data-urlencode 'client_secret=<client_secret of the M2M client application, for example: CS5v3F******>' \
     --data-urlencode 'scope=<Audience ID of the M2M server application, for example: cloud:idaas:aigateway:alibabacloud:******>|<Permission ID of the M2M server application>'

• <M2M client application Token Endpoint>: The Token Endpoint URL obtained when you Create an M2M Client Application.

• <M2M Client application client_id>: The application's client_id. For more information, see Create an M2M client application.

• <The M2M Client application's client_secret>: Set this to the client_secret that is generated when you Create an M2M Client application.

• <M2M Server application ResourceServer Identifier>: Set this to the ResourceServer Identifier specified in Create an M2M Server application.

• <M2M Server application's Scope Value>: Set this to the Scope Value described in Create an M2M Server application.

If the request is successful, a JSON response similar to the following is returned. Copy the value of access_token, which is the M2M token.

{
  "token_type": "Bearer",
  "access_token": "eyJraWQi******Nsn2u7Jcw",
  "expires_in": 3600,
  "expires_at": 1765448721
}

Call the AI Gateway using the M2M token

Go to the AI Gateway page and find the target instance. Click the instance ID to open the details page.

curl --location '<Domain Name, for example: http://env-d4t6******kv0-cn-hangzhou.alicloudapi.com>/v1/chat/completions' \
   --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <M2M Token>' \
  --data '{
    "model": "qwen-max",
    "stream": true,
    "max_tokens": 1024,
    "top_p": 0.95,
    "temperature": 1,
    "messages": [
        {
            "role": "user",
            "content": "<Prompt>"
        }
    ]
}'

from openai import OpenAI

# Configure
API_BASE_URL = "<Domain Name, for example: http://env-d4t6******kv0-cn-hangzhou.alicloudapi.com>/v1"
AUTH_TOKEN = "Bearer <M2M Token>"

# Initialize the client
client = OpenAI(
    base_url=API_BASE_URL,
    api_key="unset",
    default_headers={"Authorization": AUTH_TOKEN}
)

# Send the request and process the streaming response
stream = client.chat.completions.create(
    model="qwen-max",
    messages=[{"role": "user", "content": "<Prompt>"}],
    stream=True,
    max_tokens=1024,
    top_p=0.95,
    temperature=1
)

for chunk in stream:
    # Check if the choices list is not empty before accessing its content
    if chunk.choices and chunk.choices[0].delta.content:
        print(chunk.choices[0].delta.content, end="", flush=True)