A token authenticates requests to the Intelligent Speech Interaction API. Each request must include a valid token. A token can be reused until it expires; a new token is not required for every request. This topic describes how to obtain tokens, manage their expiration, and troubleshoot common issues.
Choose a method
|
Method |
Use case |
|
Temporary debugging and testing. |
|
|
Production environments. The application uses AccessKey credentials to obtain tokens through an SDK and refreshes them as needed. |
|
|
An SDK is unavailable for the programming language, or dependencies need to be managed directly. Implement request signing and transmission in the application. |
Token usage and expiration
How do I get a token's expiration time?
The ExpireTime field in an SDK or OpenAPI response is the token's expiration time as a Unix timestamp in seconds. Multiply this value by 1000 before passing it to a date API that accepts milliseconds. Use the time zone required by the application to display the time.
Obtain a new token before the current one expires. Console tokens are intended for temporary debugging. In production, use an SDK or OpenAPI to obtain tokens and schedule refreshes based on ExpireTime.
Can I obtain a token that never expires?
No. Tokens have a limited validity period. Obtain a new token before the current one expires.
Does obtaining a new token invalidate an existing token?
No. Obtaining a new token does not immediately invalidate an existing token. The existing token remains usable within its validity period.
Can multiple devices share a token?
A valid token can be reused and shared by multiple devices. The Appkey and token used by each device must belong to the same Alibaba Cloud account.
FAQ
How do I resolve error 40020105 when calling a speech service?
Meta:APPKEY_NOT_EXIST:Appkey not exist! indicates that the Appkey does not exist. Check the Appkey value and make sure the project and the AccessKey pair used to obtain the token belong to the same Alibaba Cloud account. If a RAM user's AccessKey pair is used, the RAM user must belong to the account that owns the project and have the required NLS permissions.
On the All Projects page of the Intelligent Speech Interaction console, check the Appkey column. In the RAM console, check the identity that owns the AccessKey pair and its permissions.
What do I do if no token or null is returned?
Check the AccessKey ID and AccessKey secret, and inspect any error information in the response.
Make sure Intelligent Speech Interaction is activated for the account.
If using a RAM user, make sure the user has permission to obtain tokens.
AliyunNLSSpeechServiceAccessincludesnls:CreateToken. IfAliyunNLSFullAccessis already granted, no additional policy is required for this permission.Check the system clock. An inaccurate clock can cause the request timestamp to differ from the actual time.
Check the service status in the Intelligent Speech Interaction console, and manage permissions in the RAM console.
For authorization instructions, see Manage RAM user permissions.
What do I do if a token is invalid or a speech request returns 403?
Use the error code and message in the response to check whether the token is entered correctly, has expired, and belongs to the same account as the Appkey. Obtain a new token if the current one has expired.
How do I resolve connect failed or Connection refused when obtaining a token?
Check the token endpoint, DNS resolution, connectivity to the HTTPS port, proxy settings, and firewall settings. Make sure the runtime environment can access the endpoint.
What do I do if an inaccurate clock causes Postman or SDK requests to fail?
Check and synchronize the system clock. The OpenAPI Timestamp parameter must use the current UTC time in the yyyy-MM-dd'T'HH:mm:ss'Z' format, such as 2026-09-28T08:00:00Z. Convert local time to UTC before using it to generate this parameter.
SDKs typically generate request timestamps from the system clock. The operating system or Postman can use the local time zone as long as the system clock is accurate.
How do I handle signatures and SignatureNonce when constructing requests?
Use a new SignatureNonce for every request. If Specified signature is not matched with our calculation is returned, check the AccessKey secret, parameter sorting, URL encoding, and whether the HTTP method used for signing matches the method used to send the request.
Sign requests using AccessKey credentials. For request parameters and the signing algorithm, see Obtain a token using OpenAPI.