Skip to main content
QwenCloud home page
Docs
More

Generate a temporary API key

Short-lived access tokens

Use a secure backend to provide temporary API keys when your application calls model services from untrusted environments like browsers or mobile apps. This prevents exposing your permanent API key.
A temporary API key inherits the permissions of the API key that created it, such as model access restrictions.

Prerequisites

Create a permanent API key in Key Management and set the DASHSCOPE_API_KEY environment variable. See Configure your API key.

Request example

Temporary API keys expire after 60 seconds by default. You can set expire_in_seconds from 1 to 1,800. 
# Singapore (ap-southeast-1). For another region, replace ap-southeast-1 in the URL.
# API keys are region-specific. See https://docs.qwencloud.com/developer-guides/getting-started/regions
curl -X POST "https://ap-southeast-1.maas.qwencloudapi.com/api/v1/tokens?expire_in_seconds=1800" \
-H "Authorization: Bearer $DASHSCOPE_API_KEY"

Sample response

Success response

{
  "token": "st-****",
  "expires_at": 1744080369
}

Response parameters

ParameterTypeDescriptionExample
tokenStringThe temporary API key.st-****
expires_atNumberExpiration time as a UNIX timestamp in seconds.1744080369

Error response

{
  "code": "InvalidApiKey",
  "message": "Invalid API-key provided.",
  "request_id": "902fee3b-f7f0-9a8c-96a1-6b4ea25af114"
}

Response parameters

ParameterTypeDescriptionExample
codeStringError code. See Error messages for details.InvalidApiKey
messageStringError message.Invalid API-key provided.
request_idStringThe request ID.902fee3b-f7f0-9a8c-96a1-6b4ea25af114

FAQ

Can I manually delete a temporary API key?

No. Temporary API keys expire automatically and cannot be deleted manually. A temporary API key inherits all permissions of the key used to create it, including access restrictions for specific models or knowledge bases.