API and SDK calls to OpenSearch-LLM-based Conversational Search Edition must be authenticated or authorized. This topic describes the methods for authentication and authorization and explains how to manage API keys.
API call authentication
You can use an API key to authenticate API calls. This method requires you to include an API key in your request. You can create and enable a maximum of 10 API keys for each instance.
To prevent your API key from being leaked:
-
Do not expose your API key publicly. Unauthorized use can lead to security risks or financial losses.
-
Initiate API calls only from the server-side. Any client-side API calls, such as from browsers, apps, or mini-programs, can expose your API key.
-
If you suspect that an API key has been compromised, sign in to the OpenSearch console to first disable and then delete the key. A disabled API key can no longer be used for API calls.
API call authorization
You can use an AccessKey for API call authorization. An AccessKey is a long-term credential provided by Alibaba Cloud. It consists of a key pair: an AccessKey ID and an AccessKey Secret.
AccessKeys are not used for signing in to the console. Instead, they are used to access Alibaba Cloud through development tools such as APIs, CLIs, SDKs, and Terraform. These tools sign requests by using the AccessKey ID and AccessKey Secret to verify the identity of the sender and the integrity of the request.
We strongly recommend that you create a dedicated RAM user for API access, create a corresponding AccessKey, and grant only the minimum required permissions. For more information, see Create an AccessKey and Create a RAM user and grant permissions.
Procedure
-
Sign in to the OpenSearch console.
-
Select the target region and switch to OpenSearch LLM-Based Conversational Search Edition.
-
In the instance list, click Manage to the right of the target instance. In the left-side navigation pane, click API keys.
-
Click Create API Key. This generates an API key. Click Copy to save the API key, or download the CSV file to save the API key information.
-
After you securely save the API key, select I have saved my API KEY. and click OK to close the dialog box.
-
Edit: Add a description for the API key.
-
View: View the API key.
-
Disable/Enable: Enables or disables the API key. A disabled key cannot be used for API calls.
-
Delete: You can only delete a disabled API key.
-
Example: API key authentication
The following example shows a curl request that uses an API key to retrieve a list of entries. To run the example, update the URL and replace the placeholder with your API key.
curl --location 'http://***.opensearch-cn-shanghai.aliyuncs.com/v3/openapi/apps/[app_group_identity]/knowledge/entries' \
--header 'Authorization: Bearer YOUR_API_KEY' \
--header 'Content-Type: application/json'Sample response:
{
"request_id":"4F6F9BDC-740F-4FC1-B976-74CAFCBF1333",
"status":"OK",
"total_count":2,
"latency":0.0,
"result":[
{
"entry_id":"ca0c8c1cec7c41a280c76c16f0db79f6",
"create_time":1718188424000,
"update_time":1718188424000,
"questions":[
"Where is the service office address for withdrawing the housing provident fund when buying an owner-occupied home in Hangzhou?"
],
"answer":"\"Hello, the service address is ****. Contact number: 0571-12329-1\""
},
{
"entry_id":"2f4c7350a7104f029f316706b61b6eb2",
"create_time":1718193627000,
"update_time":1718193627000,
"questions":[
"Can someone help me apply for deregistration of a domestic-funded branch company on my behalf?"
],
"answer":"Yes. You can authorize someone to apply on your behalf. Submit the required materials at the on-site counter. The authorizer must sign in person."
}
],
"errors":[]
}