Identity as a Service:Securely access Model Studio AI services without static keys using IDaaS M2M and AI Gateway

Create an Internet NAT gateway

1. Go to the Internet NAT Gateway purchase page, specify the following configurations, and then click Buy Now. For more information, see Create an Internet NAT gateway and associate an EIP.

   Configuration Item	Description	Example Value
   Billing Method	Only Pay-as-you-go is supported.	Pay-as-you-go
   Region	Select the region where you want to create the Internet NAT gateway.	China (Hangzhou)
   Network and Zone	Select the VPC and vSwitch for the Internet NAT gateway. You cannot change this after creation.	TEST_VPC
   Elastic IP Address	Select an option based on whether you have already created an elastic IP address (EIP).	Purchase New EIP

2. Log on to the VPC console and switch to the destination region at the top of the page. In the left navigation bar, select NAT Gateway > Internet NAT Gateway.

3. Locate the target instance and click its instance ID to open the details page.

4. Choose the SNAT Management tab and click Create SNAT Entry.

5. On the Create SNAT Entry page, set SNAT Entry Granularity to VPC, set Elastic IP Address to the currently associated EIP, and click OK.

Create an AI Gateway instance

1. Go to the AI Gateway purchase page, specify the following configurations as needed, and then click Buy Now.

   Note

   The following configurations are for creating an instance with Network Access Type set to Public Network and the minimum Gateway Specifications. Keep the default values for any unmentioned configurations. For more information, see Create a gateway instance.

   Configuration Item	Description	Example Value
   Product Type	Supports Dedicated Instance (Pay-as-you-go), Dedicated Instance (Subscription), and Serverless (Pay-as-you-go).	Dedicated Instance (Pay-as-you-go)
   Region	Select the destination region. Note Select the same region as the Internet NAT gateway instance created in the previous step.	China (Hangzhou)
   Gateway Name	Enter a custom name for the gateway.	test_gateway
   Gateway Specifications	Select the node specifications as needed. Serverless versions do not have gateway specifications.	aigw.small.x1
   Network Access Type	Supports Public Network, Private Network, and Public and Private Network access types.	Public Network
   VPC	Select the VPC where the gateway instance runs. Note Select the same VPC as the Internet NAT gateway instance created in the previous step.	TEST_VPC
   Zone Selection	Select Automatic Assignment or Manual Selection. Automatic Assignment: Select a vSwitch, and the system automatically assigns two zones to deploy the gateway nodes. Manual Selection: Manually select the zones and vSwitches to deploy the gateway nodes.	Automatic Assignment
   vSwitch	Select the vSwitch where the gateway instance runs.	VSW_1
   Service-linked Role	Click all Create Service-linked Role buttons to create the following two roles. For more information, see Service-linked Role. AliyunServiceRoleForNativeApiGw AliyunServiceRoleForNativeApiGwInvokeFC	-

2. On the Confirm Order page, review the AI Gateway configuration details and click Buy Now.

3. Return to the AI Gateway Instances page. When the Status of the created gateway changes to Running (this may take 1 to 5 minutes), the gateway has been successfully created.

Create an AI Gateway service

1. Log on to the AI Gateway console and switch to the destination region at the top. In the navigation pane on the left, choose AI Gateway > Instances.

2. Locate the target instance and click its ID to open the instance details page.

3. In the navigation pane on the left, choose Services and click Create Service. If the Configure Default Alerting panel appears, configure it as needed or ignore it.

4. In the Create Service panel that appears, configure the following parameters and then click OK.

   Note

   The following configurations use Alibaba Cloud Model Studio as an example. Keep the default values for any unmentioned configurations. For more information, see Create a service.

   Configuration Item	Description	Example Value
   Service Source	Select the type of service to proxy.	AI Service
   Service Name	Enter a custom service name.	test_bailian
   Large Model Provider	Select the large model provider to proxy.	Alibaba Cloud Model Studio
   Model Protocol	Specify the model protocol. Keep the default value.	OpenAI/v1
   Endpoint (base_url)	Set the endpoint provided by the large model provider. Keep the default value.	https://dashscope.aliyuncs.com/compatible-mode/v1
   Generation Method	Specify the generation method for the key required to access the large model.	Manual Input
   API-KEY	Set the credential required to access the large model.	sk-4901******8a59

Create a Model API

1. On the AI Gateway instance details page, choose Model API in the navigation pane on the left and click Create Model API.

2. Select a scenario and click its Create button. In the panel that appears, specify the following parameters and click OK.

   Note

   The following configurations use the Text Generation scenario as an example. Keep the default values for any unmentioned configurations. For more information, see Manage Model APIs.

   Configuration Item	Description	Example Value
   Protocol	Different protocols correspond to a set of built-in default route descriptions for that scenario. This is used to quickly generate compatible interfaces such as OpenAI, DashScope, and vLLM.	OpenAI Compatible
   API Name	Enter a custom API name. It must be globally unique within your account.	test_api
   Domain Name	The domain name to access this API. You can select multiple domain names. The combination of the domain name and the base path BasePath must be unique. To add a new domain name, click Add Domain Name on the right to create a domain name. Note If you set Network Access Type to Public Network or Public and Private Network when creating the AI Gateway instance, or if you configured a public endpoint after the instance was created, the instance can be accessed through the public endpoint. The public endpoint provided by AI Gateway has a daily call limit of 1,000. It is for testing only and must not be used in a production environment. To call AI Gateway through a specified domain name in a production environment, resolve this domain name to the public endpoint of the current AI Gateway instance using a CNAME record. The public endpoint is located under Overview > Endpoints > Endpoints and IPs on the AI Gateway instance details page.	example.aliyun.com
   Service Type	Supports Single Model Service, Multi-model Service (by Model Name), and Multi-model Service (by Weight).	Single Model Service
   Service Name	Select the target service.	test_bailian

3. On the API details page, choose the Consumer Authentication tab. Click Configuration Information > Edit. In the panel that appears, turn on the Enable switch, set Authentication Method to JWT, and click OK.

Create an IDaaS instance

1. Log on to the IDaaS Management Console and switch to the destination region at the top. In the navigation pane on the left, choose EIAM.

2. In the area on the right, click IDaaS > Create Instance. In the panel that appears, set the Description, select the Alibaba Cloud Product Service Agreement checkbox, and then click Create.

3. In the EIAM instance list, locate the target instance and click Manage in the Actions column to open the management backend for the instance.

4. In the navigation pane on the left of the EIAM instance management backend, choose Application Management > M2M Applications. In the Note on Upgrade dialog box, click Upgrade Now.

5. On the upgrade page, enable M2M Management, configure other options as needed, and then click Buy Now.

Create an M2M Client application

1. In the navigation pane on the left of the EIAM instance management backend, choose Application Management > M2M Applications.

2. Click Add Application, set Application Name to "M2M Client", and click Add to open the application details page.

3. On the General tab, click Credential Management > Client Secret Credential > Add client_secret. Select a Client Secret Validity Period and click Confirm.

4. Click View next to client_secret. Copy and save the values of client_id and client_secret for later use.

5. Copy and save the URL from Application Settings > Token Endpoint for later use.

6. On the Client Permission Management tab, turn on the Custom Permissions switch.

Create an M2M Server application

1. In the navigation pane on the left of the EIAM instance management backend, choose Application Management > M2M Applications.

2. Click Add Application, set Application Name to "M2M Server", and click Add to open the application details page.

3. On the Server Permission Control tab, under Authorized application, turn on the Server Permission Control switch. In the panel that appears, set the ResourceServer Identifier and click Confirm.

   Note

   Set ResourceServer Identifier to cloud:idaas:aigateway:alibabacloud:<account-id>. Replace <account-id> with your current Alibaba Cloud account ID.

4. Click Create Scope under Permission Management. Set the Scope Name and Scope Value, and then click Confirm.

5. Turn on the M2M Client switch under Authorized Applications. In the Permission list, select the permission you added in the previous step and click Confirm.

6. On the General tab, copy and save the URL from Application Settings > Public Key Endpoint for later use.

Create a consumer and configure JWT authentication

1. Log on to the AI Gateway console and select the destination region in the top menu bar. In the navigation pane on the left, click AI Gateway > Consumers.

2. On the Consumers list page, click Create Consumer in the upper-left corner.

3. On the Create Consumer page, specify the following parameters and click Create. For more information, see Create a consumer.

   Configuration Item	Description	Example Value
   Consumer Name	Enter a custom name for the consumer.	test_consumer
   Status	The consumer status can be Enabled or Disabled. You can manually enable or disable the consumer after it is created.	Enabled
   Authentication Method	Set the authentication method supported by the consumer: API Key, JWT, or HMAC. This example uses JWT. Creation Method: Remote Fetch. JWKS-URL: Set this to the URL from the Signature Verification Public Key Endpoint section in Create an M2M Server application. Consumer ID in JWKS Payload: key: scope. Value: Set this to the Permission Identifier from Create an M2M Server application. Configure other settings as needed or keep the default values.	JWT

Grant API permissions to the consumer

1. On the Consumers list page, click the name of the target consumer to open its details page, and then choose the Consumer Authorization tab.

2. Choose the Model API tab and click Grant.

3. In the authorization panel, select the Model API created in the previous steps and click OK. For more information, see Authorization management.

Obtain an M2M token

In a terminal that can access the internet, run the following curl command to obtain an Access Token using the client_secret_post method.

curl --location --request POST '<Token endpoint of the M2M Client application. Example: https://******.aliyunidaas.com/api/v2/iauths_system/oauth2/token>' \
     --header 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'grant_type=client_credentials' \
     --data-urlencode 'client_id=<client_id of the M2M Client application. Example: app_m5doo******>' \
     --data-urlencode 'client_secret=<client_secret of the M2M Client application. Example: CS5v3F******>' \
     --data-urlencode 'scope=<Audience of the M2M Server application. Example: cloud:idaas:aigateway:alibabacloud:******>|<Permission identifier of the M2M Server application>'

• <M2M client application's Token Endpoint>: Set this to the Token Endpoint URL that you saved in the Create an M2M Client application step.

• <M2M Client application client_id>: Set this to the client_id that you saved in the Create an M2M Client application step.

• <The client_secret for your M2M Client application>: Set this to the client_secret that you saved in the Create an M2M Client application step.

• <M2M Server application ResourceServer Identifier>: Set this to the ResourceServer Identifier that you configured in the Create an M2M Server application step.

• <M2M Server application Scope Value>: Set this to the Scope Value that you configured in the Create an M2M Server application step.

A successful request returns JSON-formatted data similar to the following. Copy the value of access_token, which is the M2M token.

{
  "token_type": "Bearer",
  "access_token": "eyJraWQi******Nsn2u7Jcw",
  "expires_in": 3600,
  "expires_at": 1765448721
}

Call AI Gateway using the M2M token

Go to the AI Gateway page, locate the target instance, and click its ID to open the instance details page.

curl --location '<Domain name. Example: http://env-d4t6******kv0-cn-hangzhou.alicloudapi.com>/v1/chat/completions' \
   --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <M2M Token>' \
  --data '{
    "model": "qwen-max",
    "stream": true,
    "max_tokens": 1024,
    "top_p": 0.95,
    "temperature": 1,
    "messages": [
        {
            "role": "user",
            "content": "<prompt>"
        }
    ]
}'

from openai import OpenAI

# Configure
API_BASE_URL = "<Domain name. Example: http://env-d4t6******kv0-cn-hangzhou.alicloudapi.com>/v1"
AUTH_TOKEN = "Bearer <M2M Token>"

# Initialize the client
client = OpenAI(
    base_url=API_BASE_URL,
    api_key="unset",
    default_headers={"Authorization": AUTH_TOKEN}
)

# Send the request and process the streaming response
stream = client.chat.completions.create(
    model="qwen-max",
    messages=[{"role": "user", "content": "<prompt>"}],
    stream=True,
    max_tokens=1024,
    top_p=0.95,
    temperature=1
)

for chunk in stream:
    # Check if the choices list is not empty before accessing its content
    if chunk.choices and chunk.choices[0].delta.content:
        print(chunk.choices[0].delta.content, end="", flush=True)