how to obtain an API key - Alibaba Cloud Model Studio - Alibaba Cloud Documentation Center

Get an API key to call models and applications in Alibaba Cloud Model Studio.

Get an API key

Important

Use your Alibaba Cloud account or a RAM user with administrator or API key page permissions.

Singapore and other regions

Go to the Alibaba Cloud Model Studio console. In the upper-right corner, select your target region. Go to the API key page and click Create API Key.
Configure the following parameters and click OK:
- Owner Account: Select the Alibaba Cloud account. The value in the Account column is a numeric account ID.
- Workspace: Select the default workspace.
Click the icon next to the API key to copy it.
Alibaba Cloud accounts can view all API keys. RAM users can only view the API keys that they create.

China (Beijing) region

Go to the Alibaba Cloud Model Studio console. In the upper-right corner, select your target region. Go to the API key page and click Create API Key.
Configure the following parameters and click OK:
- Workspace: Select the default workspace.
- Permission: Select All. For more fine-grained permission control, select Custom to control the IP address whitelist for the API key.
How do I choose the permission configuration for an API key?
Alibaba Cloud Model Studio provides two permission configurations. Select one based on your requirements:
- All: Grants permission to call all models and applications.
- Custom: Grants access to specific models or applications on demand, following the principle of least privilege. You can configure the following:
  - IP address whitelist: Allows only IP addresses in the whitelist to use this API key for API calls.
Click the icon next to the API key to copy it.
Alibaba Cloud accounts can view all API keys. RAM users can only view the API keys that they create.

When should you choose a different owner account or workspace?

If you have team collaboration or cost allocation needs, consider the following:

Workspace: Workspaces isolate resources and permissions for different projects or teams. To control model access for specific users or allocate costs for model calls, create or select a sub-workspace from the list.

For more information, see API key permissions and Bill query and cost management.

Use API keys

Note

Coding Plan requires a dedicated API key with the format sk-sp-xxxxx, not the general Model Studio API key with the format sk-xxxxx. To get the dedicated API key for your Coding Plan, see Get your plan-specific API key and base URL.

Method 1: Call models in a third-party tool
If you use a third-party tool such as Chatbox to call a model, provide the following:
- API key
- Base URL for your API key's region:
  - Singapore: https://dashscope-intl.aliyuncs.com/compatible-mode/v1
  - US (Virginia): https://dashscope-us.aliyuncs.com/compatible-mode/v1
  - China (Beijing): https://dashscope.aliyuncs.com/compatible-mode/v1
  - China (Hong Kong): https://cn-hongkong.dashscope.aliyuncs.com/compatible-mode/v1
  - Germany (Frankfurt): https://{WorkspaceId}.eu-central-1.maas.aliyuncs.com/compatible-mode/v1. When making a call, replace WorkspaceId with your actual workspace ID.
- Model name, such as qwen-plus

Guides for common tools: Chatbox, Cline, Claude Code, Dify, OpenClaw (formerly Clawdbot/Moltbot), Postman, and Qwen Code.

Method 2: Call models by using code
When calling the Qwen API with code, configure your API key as an environment variable to avoid hardcoding it in your source code.

Never expose your API key publicly. Unauthorized use can lead to security breaches or financial loss.

API key permissions

The permissions of an API key are determined entirely by its workspace. API keys within the same workspace have the same permissions. You do not need separate API keys for different models, such as text-to-text, text-to-image, or speech synthesis models.

API keys in the default workspace: Can be used to call all standard models and applications in the default workspace.
API keys in a sub-workspace: Can be used to call standard models to which the sub-workspace has been granted authorization, and applications within that sub-workspace.

Note

Currently, only the China (Beijing) region supports more fine-grained permission control for API keys.

Click Create API Key or Edit for an existing API key, then switch Permission to Custom to configure the following:

IP Address Whitelist: Allows only IP addresses in the whitelist to use this API key for API calls.

API key validity

API keys remain valid permanently unless deleted manually.

To grant temporary access to third-party applications or users, or to control high-risk operations such as accessing or deleting sensitive data, you can generate a temporary API key (valid for 60 seconds). This avoids exposing long-term API keys and reduces the risk of leaks.

FAQ

Q: What is the maximum number of API keys I can create under a single Alibaba Cloud account?

A: You can create up to 20 API keys in each workspace. An Alibaba Cloud account can have up to 10 workspaces, including the default one.

Q: If a RAM user is deleted, can the API keys they created still be used?

A: After you disable or delete a RAM user on the RAM console, all API keys created by that user can no longer be used to call models.