Before you use models or applications in Alibaba Cloud Model Studio, you must obtain an API key for authentication.
This topic describes the pay-as-you-go API key for Model Studio. If you are using a Token Plan or Coding Plan, use the corresponding dedicated API key (starts with sk-sp-). For more information, see Token Plan API Key and Coding Plan API Key.
Create an API key
This procedure must be performed by an Alibaba Cloud account or a RAM user with administrator or API-Key page permissions.
China (Beijing), Singapore, and other regions
Go to the Alibaba Cloud Model Studio console. In the upper-right corner, select a region, such as China (Beijing), Singapore, Japan (Tokyo), China (Hong Kong), or Germany (Frankfurt). Go to the API Key page and click Create API Key.
In the dialog box, configure the following settings and click OK:
Workspace: We recommend that you select the default workspace.
Permission: We recommend that you select All. For more granular control, select Custom to configure accessible IP addresses and models.
Alibaba Cloud Model Studio provides two types of permission settings. Select one based on your business requirements:
All: Grants the API key permission to call all models and applications.
Custom: Allows you to configure an IP address whitelist and an accessible model scope.
By default, all IPv4 (
0.0.0.0/0) traffic is allowed. Support for IPv6 is available only in the China (Beijing) region.You can add up to 20 IPv4 or IPv6 addresses or CIDR blocks to the IP address whitelist.
After the key is created, the complete API key is displayed in a dialog box. You must copy or download and save it immediately. Keep it confidential. Anyone with your API key can make service requests on your behalf, which may incur charges. After you close the dialog box, you cannot view or copy the plaintext API key again. If the key is lost, reset it or create a new one.
An Alibaba Cloud account can view all API keys. A RAM user can view only the API keys that they have created.
On the API key management page, click + Create API key in the upper-right corner to create another key. For an existing API key, you can Disable, Edit, or Delete it in the Actions column.
US (Virginia) region
Go to the Alibaba Cloud Model Studio console. In the upper-right corner, switch the region to US (Virginia). On the Dashboard tab, choose API Key from the left-side navigation pane. On the API key management page, click Create API Key.
In the dialog box, configure the following information and click OK:
Workspace: We recommend that you select the default workspace.
Description: Enter a description to help you identify the purpose of the API key.
After the key is created, the complete API key is displayed in a dialog box. Copy it immediately and store it securely. You cannot view the complete API key again after you close the dialog box.
In the API key list, click the
icon next to an API key to copy the masked key.An Alibaba Cloud account can view all API keys. A RAM user can view only the API keys that they have created.
Click the + Create API key button in the upper-right corner to create a new API key.
Use an API key
Method 1: Call models from third-party tools
Configuration guides for common tools: Chatbox, Cline, Claude Code, Dify, OpenClaw, Postman, and Qwen Code.
Method 2: Call models by using code
When you call the Qwen API for the first time by using code, we recommend that you configure the API key as an environment variable to avoid hard-coding it in your code, which reduces the risk of leaks.
Do not expose your API key.
API key security upgrade
Model Studio has upgraded the pay-as-you-go API key generation and storage mechanism for enhanced security (except for the US (Virginia) region). The following table describes the main differences between API keys created before and after the upgrade.
Comparison item | Pre-upgrade keys | Post-upgrade keys |
Key format | Starts with | Starts with |
Plaintext viewing | You can copy the complete plaintext key from the console at any time. | The plaintext key is displayed only once upon creation. It cannot be viewed again after the dialog box is closed. If lost, reset or create a new key. |
Calling capability | Can be used to call models normally; functionality is unaffected. | Can be used to call models normally; functionality is identical to pre-upgrade keys. |
Recommended action | We recommend that you create a new key to replace the old one for improved security. | Copy and save the key immediately after creation, and store it securely. |
API key permissions
An API key's permissions are determined entirely by its workspace. All API keys within the same workspace have identical permissions. You do not need to create different API keys for different models, such as text-to-text, text-to-image, or speech synthesis models.
API key in the default workspace: Can call all standard models and any application within the default workspace.
API key in a sub-workspace: Can call standard models authorized for the sub-workspace and any application within that sub-workspace.
When you Create API Key or click Edit for an existing API key, you can switch the Permissions to Custom to configure the following:
The following configurations are not supported in the US (Virginia) region.
IP address whitelist: Allows only IP addresses on the whitelist to use the API key to make calls (supports IPv4, IPv6, and CIDR blocks).
Access Scope: Select the specific models or applications that this API key can access. The key cannot call unselected resources.
API key validity
API keys do not expire. They remain valid until you manually delete them.
To grant temporary access to third-party applications or users, or to strictly control high-risk operations such as accessing or deleting sensitive data, you can generate a temporary API key (valid for 60 seconds). This avoids exposing a long-term API key and reduces the risk of leaks.
Error codes
If a model call fails and returns an error message, see Error codes for troubleshooting.
FAQ
Q: How many API keys can I create under a single Alibaba Cloud account?
A: For the Singapore, China (Beijing), China (Hong Kong), Japan (Tokyo), and Germany (Frankfurt) regions, each Alibaba Cloud account can create up to 50 API keys per region.
For the US (Virginia) region, each owner account, including the Alibaba Cloud account, can create up to 20 API keys.
Q: Are API keys created by a RAM user still valid after the user is deleted?
A: No. After you disable or delete a RAM user in the RAM console, all API keys created by that user become invalid and can no longer be used for model calls.