Skip to main content
Qwen Cloud home page
Docs
More

Generate a temporary API key

Short-lived access tokens

Use a secure backend to provide temporary API keys when your application calls model services from untrusted environments like browsers or mobile apps. This prevents exposing your permanent API key.
A temporary API key inherits the permissions of the API key that created it, such as model access restrictions.

Prerequisites

Create a permanent API key in Key Management and set the DASHSCOPE_API_KEY environment variable. See Configure your API key.

Request example

Temporary API keys expire after 60 seconds by default. You can set expire_in_seconds from 1 to 1,800. 
curl -X POST "https://dashscope-intl.aliyuncs.com/api/v1/tokens?expire_in_seconds=1800" \
-H "Authorization: Bearer $DASHSCOPE_API_KEY"

Sample response

Success response

{
  "token": "st-****",
  "expires_at": 1744080369
}

Response parameters

ParameterTypeDescriptionExample
tokenStringThe temporary API key.st-****
expires_atNumberExpiration time as a UNIX timestamp in seconds.1744080369

Error response

{
  "code": "InvalidApiKey",
  "message": "Invalid API-key provided.",
  "request_id": "902fee3b-f7f0-9a8c-96a1-6b4ea25af114"
}

Response parameters

ParameterTypeDescriptionExample
codeStringError code. See Error messages for details.InvalidApiKey
messageStringError message.Invalid API-key provided.
request_idStringThe request ID.902fee3b-f7f0-9a8c-96a1-6b4ea25af114

FAQ

Can I manually delete a temporary API key?

No. Temporary API keys expire automatically and cannot be deleted manually.