All Products
Search

This Product

    Platform For AI:Configuration management

    Document Center

    Platform For AI:Configuration management

    Last Updated:Sep 01, 2026

    PAI CLI uses the config subcommand to manage configuration profiles. You can maintain multiple profiles in parallel, use different authentication methods, and override endpoints per profile.

    Configuration file

    All PAI CLI configuration is stored in ~/.pai/config.json as a JSON file.

    The file supports multiple named profiles. Each profile holds its own credentials, region, workspace, and endpoint settings, so you can switch between environments such as development and production without reconfiguring.

    config init

    pai config init [--profile NAME]

    Starts an interactive wizard that walks you through credential, region, and workspace setup. Two design guarantees:

    • Credentials already provided by environment variables or an instance RAM role are detected and reused — they're not copied into the configuration file. This prevents frozen temporary credentials from expiring mid-session.

    • Every value is validated against a live API call before it's written to the file.

    Note

    For scripts and non-interactive scenarios, use pai config set instead.

    config show

    pai config show [--profile NAME]

    Displays the effective configuration and the source of each value. Unlike config list, which prints the raw profile file, show outputs the resolution chain the command actually uses: flag > profile > PAI_ > ALIBABA_CLOUD_. This is useful for troubleshooting issues such as "why is this command hitting a different region?"

    Configure credentials

    # Method 1: AccessKey credentials (most common)
pai config set access_key_id LTAI5xxxxxxxxxxxxx
pai config set access_key_secret xxxxxxxxxxxxxxxxxxxxxxxx

# Method 2: STS temporary credentials
pai config set access_key_id STS.xxxxxxxxxxxxx
pai config set access_key_secret xxxxxxxxxxxxxxxxxxxxxxxx
pai config set security_token xxxxxxxxxxxxxxxxxxxxxxxx

# Method 3: ECS RAM role (when running on an ECS instance)
pai config set credential_type ecs_ram_role
pai config set role_name my-ram-role

# Method 4: RAM role AssumeRole
pai config set credential_type ram_role_arn
pai config set role_arn acs:ram::123456789:role/my-role
    Note

    Credential resolution priority: explicit credential_type → access_key_id + access_key_secret (STS if security_token is also set) → default Alibaba Cloud credential chain (ALIBABA_CLOUD_* environment variables → ~/.aliyun/credentials → ECS RAM role → OIDC).

    Note

    DSW instances don't require AccessKey configuration: If your execution environment runs inside a DSW instance that has an instance RAM role attached, you don't need to configure an AccessKey. The CLI automatically retrieves temporary credentials from the instance metadata server and runs all commands with the identity and permissions of the instance owner.

    config set

    pai config set <key> <value> [--profile NAME]

    Parameter

    Type

    Default

    Description

    region

    string

    —

    Region ID. Environment variable: PAI_REGION, falls back to ALIBABA_CLOUD_REGION_ID

    workspace_id

    string

    —

    Default workspace ID. Environment variable: PAI_WORKSPACE_ID

    access_key_id

    string

    —

    AccessKey ID. Environment variable: PAI_ACCESS_KEY_ID

    access_key_secret

    string

    —

    AccessKey secret (masked in config list output)

    security_token

    string

    —

    STS temporary token. Setting this automatically switches to STS authentication

    credential_type

    string

    —

    Authentication type: access_key sts ecs_ram_role ram_role_arn oidc_role_arn credentials_uri

    role_name

    string

    —

    ECS instance RAM role name (used when credential_type=ecs_ram_role)

    role_arn

    string

    —

    RAM role ARN (used when credential_type is ram_role_arn or oidc_role_arn)

    role_session_name

    string

    —

    AssumeRole session name, recorded in audit logs

    oidc_provider_arn

    string

    —

    OIDC provider ARN (ACK RRSA scenarios)

    oidc_token_file

    string

    —

    Path to the OIDC token file

    credentials_uri

    string

    —

    HTTP address of an external credential service

    endpoint

    string

    —

    Global API endpoint override (prefer product-level endpoints when possible)

    endpoint_dsw

    string

    —

    DSW product endpoint

    endpoint_dlc

    string

    —

    DLC product endpoint

    endpoint_aiworkspace

    string

    —

    AIWorkspace product endpoint

    endpoint_eas

    string

    —

    EAS product endpoint

    endpoint_paistudio

    string

    —

    PAIStudio (quota/resource group) product endpoint

    protocol

    string

    https

    Communication protocol: http https

    config get

    pai config get <key> [--profile NAME]

    config list

    pai config list [--profile NAME]

    Displays all configuration values in the current profile. Sensitive fields are automatically masked.

    Manage multiple profiles

    # Create a development profile
pai config set access_key_id LTAI5xxxxxxxxxxxxx --profile dev
pai config set access_key_secret xxxxxxxxxxxxxxxxxxxxxxxx --profile dev
pai config set region cn-hangzhou --profile dev

# Create a production profile
pai config set access_key_id LTAI5yy********yy --profile prod
pai config set access_key_secret yyyyyy******yyyyyyyy --profile prod
pai config set region cn-shanghai --profile prod

# Switch between profiles
pai dsw instance list --profile dev
pai dsw instance list --profile prod