To call model services from untrusted environments, such as browsers and mobile apps, use a secure backend service to generate temporary API keys. This prevents your permanent API key from being exposed.
A temporary API key inherits all permissions from the API key that creates it, including access restrictions for specific models or knowledge bases.
Prerequisites
Get a permanent API key on the Key Management (Singapore), Key Management (Virginia), Key Management (Beijing), or Key Management (China (Hong Kong)) page. Then, set the key as the DASHSCOPE_API_KEY environment variable. For more information, see Configure an API key as an environment variable.
Request example
By default, a temporary API key is valid for 60 seconds. You can set a custom time-to-live (TTL) between 1 and 1,800 seconds.
API keys differ by region.
The following URL is for the Singapore region. To use a model in the Beijing region, replace the URL with: https://dashscope.aliyuncs.com/api/v1/tokens?expire_in_seconds=1800
curl -X POST "https://dashscope-intl.aliyuncs.com/api/v1/tokens?expire_in_seconds=1800" \
-H "Authorization: Bearer $DASHSCOPE_API_KEY" Response example
Successful response example
{
"token":"st-****",
"expires_at":1744080369
}Response parameters
Parameter | Type | Description | Example |
token | String | Generated temporary API key. | st-**** |
expires_at | Number | Expiration time in UNIX timestamp (seconds). | 1744080369 |
Error response example
{
"code":"InvalidApiKey",
"message":"Invalid API-key provided.",
"request_id":"902fee3b-f7f0-9a8c-96a1-6b4ea25af114"
}Response parameters
Parameter Name | Type | Description | Example |
code | String | Error code. For more information about causes and solutions, see Error messages. | InvalidApiKey: The API key is invalid. |
message | String | Error message. | Invalid API-key provided. |
request_id | String | Request ID. | 902fee3b-f7f0-9a8c-96a1-6b4ea25af114 |
FAQ
Q: Can I manually delete a created temporary API key?
A: No. A temporary API key has a fixed lifecycle and automatically expires.