All Products
Search

This Product

    Alibaba Cloud Model Studio:Get Authentication Credentials

    Document Center

    Alibaba Cloud Model Studio:Get Authentication Credentials

    Last Updated:Sep 18, 2026

    Obtain the authentication credentials required by the HappyOyster server and client: API Host, primary API Key, temporary API Key, and ticket.

    For the overall HappyOyster architecture, see the Overview.

    Authentication Credentials

    All APIs are authenticated through the Alibaba Cloud Model Studio gateway. Three credentials are involved:

    Credential

    Used by

    Purpose

    Validity

    Primary API Key

    Server only

    Calls all Open APIs (manage worlds, exchange for tickets, generate temporary API Keys, query artifacts)

    Long-lived

    Temporary API Key
    (also called token in the SDK)

    Client SDK

    HTTP-layer authentication for the SDK (injected via updateToken); simply fetch and inject again after expiration

    Default 1 minute, up to 30 minutes (configured via expire_in_seconds); must be renewed

    ticket

    Client SDK

    Single-use credential for entering the room; exchanged on the server and delivered to the client

    30 minutes, single-use

    Credential flow:

    • The primary API Key is held only by your server and must never be exposed to the client.
    • Your server uses the primary API Key to generate the temporary API Key and the ticket, then delivers them to the client.
    • The client injects the temporary API Key (token) via updateToken. When it expires, request a new one from your server and inject it again — there is no need to re-exchange the ticket.
    • The ticket is a single-use room-entry credential, valid for 30 minutes, and invalidated once used. Each new Travel requires a fresh ticket.

    Get Authentication Credentials

    The API Host and primary API Key are obtained from the Model Studio console. The temporary API Key and ticket are issued by your server via the corresponding APIs and delivered to the client.

    ImportantThe primary API Key must stay on the server side; client SDKs must only use the temporary API Key. Never deliver the primary API Key to a client or bundle it into an App for distribution.

    NoteThe API Host and API Key must belong to the same workspace; otherwise, AccessDenied is returned.

    1. Get the API Host

    On the Workspace Management page, copy the value in the API Host column. Both your server and the client SDK need this API Host.

    2. Get the Primary API Key

    See Get and configure an API Key. The primary API Key must be stored only on your server; do not deliver it to the client or bundle it into an App for distribution.

    3. Get the Temporary API Key

    On the server, use the primary API Key to call the Generate Temporary API Key endpoint, then deliver the returned temporary API Key to the client SDK and inject it via updateToken. When it expires, generate a new one and inject it again — there is no need to re-exchange the ticket.

    4. Get the ticket

    On the server, use the primary API Key to call the Get Travel Credential endpoint that corresponds to your world's mode, obtain the single-use room-entry ticket, and deliver it to the client:

    Each ticket is bound one-to-one with a Travel and can be used once within 30 minutes; each new Travel requires a fresh ticket.

    Next Steps

    • Integration Flow: The server prepares worlds, delivers credentials, and retrieves artifacts; the client SDK handles the real-time experience.