Skip to main content
QwenCloud home page
Docs
Quick Start

Get Authentication Credentials

Obtain the authentication credentials required by the HappyOyster server and client: API Host, primary API Key, temporary API Key, and ticket.

For the overall HappyOyster architecture, see the Overview.

Authentication Credentials

All APIs are authenticated through the Alibaba Cloud QwenCloud gateway. Three credentials are involved:

Credential

Used by

Purpose

Validity

Primary API Key

Server only

Calls all Open APIs (manage worlds, exchange for tickets, generate temporary API Keys, query artifacts)

Long-lived

Temporary API Key
(also called token in the SDK)

Client SDK

HTTP-layer authentication for the SDK (injected via updateToken); simply fetch and inject again after expiration

Default 1 minute, up to 30 minutes (configured via expire_in_seconds); must be renewed

ticket

Client SDK

Single-use credential for entering the room; exchanged on the server and delivered to the client

30 minutes, single-use

Credential flow:
  • The primary API Key is held only by your server and must never be exposed to the client.
  • Your server uses the primary API Key to generate the temporary API Key and the ticket, then delivers them to the client.
  • The client injects the temporary API Key (token) via updateToken. When it expires, request a new one from your server and inject it again — there is no need to re-exchange the ticket.
  • The ticket is a single-use room-entry credential, valid for 30 minutes, and invalidated once used. Each new Travel requires a fresh ticket.

Get Authentication Credentials

The primary API Key is obtained from the QwenCloud console; the API Host is fixed at https://dashscope-intl.aliyuncs.com. The temporary API Key and ticket are issued by your server via the corresponding APIs and delivered to the client.
Only during local integration testing may you temporarily inject the primary API Key into the SDK to walk through the flow. Once you distribute externally or integrate with another party's client, you must switch to the temporary API Key. Never deliver the primary API Key to a client or bundle it into an App for distribution.

1. Confirm the API Host

The HappyOyster Open API and client SDK API Host is https://dashscope-intl.aliyuncs.com; no console lookup is required. Configure both your server and client SDK with this host.

2. Get the Primary API Key

See Get and configure an API Key. The primary API Key must be stored only on your server; do not deliver it to the client or bundle it into an App for distribution.

3. Get the Temporary API Key

On the server, use the primary API Key to call the Generate Temporary API Key endpoint (POST https://dashscope-intl.aliyuncs.com/api/v1/tokens; the temporary key starts with st-, inherits the primary key's permissions, TTL 1–1800s), then deliver the returned temporary API Key to the client SDK and inject it via updateToken. When it expires, generate a new one and inject it again — there is no need to re-exchange the ticket.

4. Get the ticket

On the server, use the primary API Key to call the Get Travel Credential endpoint that corresponds to your world's mode, obtain the single-use room-entry ticket, and deliver it to the client: Each ticket is bound one-to-one with a Travel and can be used once within 30 minutes; each new Travel requires a fresh ticket.

Next Steps

  • Integration Flow: The server prepares worlds, delivers credentials, and retrieves artifacts; the client SDK handles the real-time experience.