Installation & Authentication - Alibaba Cloud Model Studio

Install the Bailian CLI and Skills, configure authentication, and verify.

This page covers how to install the Bailian CLI, install the companion Skills, and configure authentication.

Prerequisites

Network access (either the npm registry or bailian.aliyun.com, depending on the install method you choose below).
For the npm method: Node.js >= 18.17.0 (verify with node -v) and npm (verify with npm -v). If you don't have Node.js, or your version is too old, use the binary install script below instead — no Node.js required.

Install the CLI

npm (existing Node.js)

npm install -g bailian-cli

Even if pnpm / yarn is installed, use npm to install bailian-cli — do not use pnpm / yarn to install the CLI.

Binary script (no Node.js required)

macOS / Linux:

curl -fsSL https://bailian.aliyun.com/cli/install.sh | bash

Windows (PowerShell):

irm https://bailian.aliyun.com/cli/install.ps1 | iex

After installation, two commands are added to your PATH: bl (short alias) and bailian (full name). Verify:

bl --version
which bl   # use "where bl" on Windows

Run bl update at any time to check for and install the latest CLI version.

NoteIf you see command not found, check that the global bin directory is on your PATH: for the npm install, run npm config get prefix and add its bin subdirectory to PATH; for the binary install, add the path printed by the install script.

Install Skills

Once the CLI is verified, install the companion Skills so your Agent gains the full range of Bailian capabilities. The recommended, one-shot method is the CLI's built-in bootstrap command:

bl skill init

This installs every bailian-* Skill in the registry (plus the shared bailian-protocol) in one go, and is the officially recommended install path. If bl skill init is unavailable, use the skills tool instead (it requires Git on the machine; the latest skills package requires Node.js >= 22.20, so pin skills@1.5.18 on Node.js 18):

npx skills@1.5.18 add modelstudioai/cli --skill '*' -g

To install a single Skill, replace --skill '*' with its name; --list shows all Skills in the repository.

Configure authentication

You must authenticate before calling any API. Choose one of the methods below based on your environment.

Best for interactive local installs — no need to copy an API Key manually. This command opens a browser to complete Alibaba Cloud console login and authorization:

bl auth login --console

This also unlocks console capabilities such as app list and usage free, and automatically configures the credentials needed for API Key calls.

Standard API Key

Best for environments where a browser cannot be launched (remote SSH, CI, etc.). Get a Key from the Bailian console API Key page, then run:

bl auth login --api-key <your_API_Key>

The login command tests the Key before saving it.

Token Plan

Use the API Key from your Token Plan subscription:

bl auth login --config token-plan --api-key <your_API_Key>

The token-plan profile ships with a built-in default Base URL, so no extra endpoint configuration is needed.

AK/SK access token

For generating a CLI access token from an Alibaba Cloud AccessKey (e.g. to pair with tools like Postman). --access-key-id and --access-key-secret are required:

bl auth generate-access-token --access-key-id <AccessKey ID> --access-key-secret <AccessKey Secret>

The generated temporary access token can be used for subsequent calls, avoiding long-term exposure of your AK/SK; add --security-token when using STS temporary credentials.

Environment variable

Not persisted to a config file — set DASHSCOPE_API_KEY in your shell (the endpoint can be overridden with BAILIAN_BASE_URL). Ideal for CI / non-interactive environments; inject via secret management rather than hardcoding in scripts.

Standard API Keys and Token Plan subscription keys differ as follows:

Aspect	Standard API Key	Token Plan API Key
Billing	Pay-as-you-go (includes new-user free quota)	Deducts from your Token Plan subscription quota
Scope	Model service calls	Calls to models supported by Token Plan
Typical use	No subscription, or pay-as-you-go	Token Plan subscribers consuming plan quota first
Setup	`bl auth login --api-key <Key>`	`bl auth login --config token-plan --api-key <sk-sp-Key>`

Verify

The login command already tests usability, so you only need to confirm the configuration status:

bl auth status --output json

No repeated model-call test is needed. If login fails, use the hint or message in the output to troubleshoot (network, invalid Key, base_url, etc.).

WarningWhen reporting auth status, use only masked fields. Never echo a full API Key, and do not write real Keys into repositories, logs, or the public parts of chat records.

Log out

To clear local credentials and sign out, run:

bl auth logout

Troubleshooting

bl: command not found

The global bin directory is not on your PATH. Run npm config get prefix and add its bin subdirectory to PATH, then retry.

engines error during install

Node.js version too low. Upgrade to >= 18.17.0 and reinstall.

401 / authentication failure

Not logged in or invalid API Key. Re-run the login command for your Key type (standard API Key or Token Plan).

Why doesn't a CLI model call deduct from my Token Plan?

The active credential is a standard API Key (the default profile). Token Plan requires your subscription API Key signed in to the token-plan profile; run bl auth status --output json to see which credential is active.

How do I make CLI model calls use my Token Plan?

Sign in with your subscription API Key: bl auth login --config token-plan --api-key <sk-sp-Key>. If the profile already exists, switch to it with bl config use --name token-plan.

Can I use every CLI feature with only a Token Plan API Key?

No. Model-call commands work; console features (such as app list, usage free, workspace) require console login (bl auth login --console), and Token Plan seat management additionally needs Alibaba Cloud OpenAPI AK/SK credentials. See Configure authentication for the comparison.

How do I check and switch the active API Key?

Run bl auth status --output json to inspect the active credential (masked), bl config list to list all profiles, and bl config use --name <profile> to switch the active profile.

Corporate network can't reach npm

Configure a mirror or proxy, then reinstall.

Only pnpm available, no npm

Use the binary install script instead (no Node.js/npm required): curl -fsSL https://bailian.aliyun.com/cli/install.sh | bash. Alternatively, install or repair npm first, then use npm install -g bailian-cli — but do not use pnpm / yarn to install the CLI.