# Generate a temporary API key

> To call model services from untrusted environments such as browsers and mobile apps, use a secure backend service to generate temporary API keys. This prevents your permanent API key from being exposed.

<Tip>
  A temporary API key inherits all permissions from the API key used to create it, including access restrictions for specific models or knowledge bases.
</Tip>

## Prerequisites <span id="prerequisite-title" /> <span id="prerequisite-section" />

Get a permanent API key on the [API Key (Singapore)](https://modelstudio.console.alibabacloud.com/model/settings/api-key), [API Key (Virginia)](https://modelstudio.console.alibabacloud.com/us-east-1/settings/api-key), [API Key (Beijing)](https://modelstudio.console.alibabacloud.com/model/settings/api-key), or [API Key (China (Hong Kong))](https://modelstudio.console.alibabacloud.com/cn-hongkong/settings/api-key) page. Then set the key as the `DASHSCOPE_API_KEY` environment variable. For more information, see Configure an API key as an environment variable.

## Request example <span id="a983ecd685kjl" /> <span id="3c8cd89270f1q" />

By default, a temporary API key is valid for 60 seconds. Set a custom time-to-live (TTL) between 1 and 1,800 seconds using the `expire_in_seconds` parameter.

> API keys differ by region.

> The following example uses the Singapore region endpoint. Replace `WorkspaceId` with your actual [workspace ID](/help/en/model-studio/obtain-the-app-id-and-workspace-id#d3eb3cd37b7fu). For the Beijing region, replace the URL with: [https://dashscope.aliyuncs.com/api/v1/tokens?expire\_in\_seconds=1800](https://dashscope.aliyuncs.com/api/v1/tokens?expire_in_seconds=1800)

```bash
# This is the Singapore region URL. Replace WorkspaceId with your actual workspace ID. URLs differ by region.
curl -X POST "https://{WorkspaceId}.ap-southeast-1.maas.aliyuncs.com/api/v1/tokens?expire_in_seconds=1800" \
-H "Authorization: Bearer $DASHSCOPE_API_KEY"
```

## Response example <span id="a8b797d312yzo" /> <span id="ff20c08cb94um" />

<Tabs>
  <Tab title="Successful response example">
    ```json
    {
        "token":"st-****",
        "expires_at":1744080369
    }
    ```

    ### Response parameters <span id="6995707ed2t3w" /> <span id="104320cf43t5z" />

    <table style={{ display: "table", tableLayout: "fixed", width: "100%" }}><colgroup><col style={{ width: "16.62%" }} /><col style={{ width: "14.49%" }} /><col style={{ width: "33.33%" }} /><col style={{ width: "35.56%" }} /></colgroup><thead><tr><th><p><strong>Parameter</strong></p></th><th><p><strong>Type</strong></p></th><th><p><strong>Description</strong></p></th><th><p><strong>Example</strong></p></th></tr></thead><tbody><tr><td><p>token</p></td><td><p>String</p></td><td><p>Generated temporary API key.</p></td><td><p>st-\*\*\*\*</p></td></tr><tr><td><p>expires\_at</p></td><td><p>Number</p></td><td><p>Expiration time as a UNIX timestamp, in seconds.</p></td><td><p>1744080369</p></td></tr></tbody></table>
  </Tab>

  <Tab title="Error response example">
    ```json
    {
        "code":"InvalidApiKey",
        "message":"Invalid API-key provided.",
        "request_id":"902fee3b-f7f0-9a8c-96a1-6b4ea25af114"
    }
    ```

    ### Response parameters <span id="cd5ad1efc01q6" /> <span id="ccf1e79c1f4nr" />

    <table style={{ display: "table", tableLayout: "fixed", width: "100%" }}><colgroup><col style={{ width: "16.62%" }} /><col style={{ width: "14.49%" }} /><col style={{ width: "33.33%" }} /><col style={{ width: "35.56%" }} /></colgroup><thead><tr><th><p><strong>Parameter</strong></p></th><th><p><strong>Type</strong></p></th><th><p><strong>Description</strong></p></th><th><p><strong>Example</strong></p></th></tr></thead><tbody><tr><td><p>code</p></td><td><p>String</p></td><td><p>Error code. For causes and solutions, see <a href="/help/en/model-studio/error-code">Error codes</a>.</p></td><td><p>InvalidApiKey: The API key is invalid.</p></td></tr><tr><td><p>message</p></td><td><p>String</p></td><td><p>Error message.</p></td><td><p>Invalid API-key provided.</p></td></tr><tr><td><p>request\_id</p></td><td><p>String</p></td><td><p>Request ID.</p></td><td><p>902fee3b-f7f0-9a8c-96a1-6b4ea25af114</p></td></tr></tbody></table>
  </Tab>
</Tabs>

## FAQ

<strong>Q: Can I manually delete a temporary API key?</strong>

A: No. Temporary API keys have a fixed lifecycle and expire automatically. You cannot delete them before they expire.