Skip to main content
Qwen Cloud home page
Docs
Administration

API keys

Create and manage API keys

Overview

Every API request to Qwen Cloud requires an API key for authentication. Each API key belongs to one workspace — the key inherits the workspace's model access and rate limits. For a quick guide on getting your first API key, see Get an API key.

Create an API key

1

Select a workspace

Go to the API Keys page. Use the workspace switcher at the bottom of the sidebar to select the workspace where you want to create the key.
2

Create the key

Click Add API Key. Enter a description to help you identify the key later (such as "Production API key for main application"), then click Generate Key.
3

Copy the key

Copy the API key immediately — it is shown only once. After you close the dialog, you can only see a masked version of the key.
Each workspace supports up to 20 API keys. The current count is displayed on the Add API Key button (such as 1/20).

Manage API keys

From the API Keys page, you can:
  • Search: Find keys by API Key ID.
  • Edit: Click Edit to update the key's description.
  • Delete: Click Delete to permanently revoke the key. This action cannot be undone — all requests using this key will immediately fail.
The API keys table shows each key's ID, Secret Key (masked), Status, Description, and available Actions.

API keys and workspaces

API keys are scoped to the workspace where they are created:
  • Keys in the default workspace can call all available models with account-level rate limits.
  • Keys in a sub-workspace can only call models that have been granted to that workspace, with the rate limits configured for that workspace.
To manage API keys for a different workspace, switch to it using the workspace switcher at the bottom of the sidebar.

API endpoints

Use your API key with the following endpoint:
  • OpenAI Compatible: https://dashscope-intl.aliyuncs.com/compatible-mode/v1
The endpoint URL is displayed at the bottom of the API Keys page with a copy button.
API calls via DashScope use the pay-as-you-go billing option and will not consume your Coding Plan subscription quota.

Security best practices

  • Store keys securely: Use environment variables or a secrets manager. Never hardcode API keys in source code.
  • Don't expose keys client-side: API keys should only be used in server-side code. Never include them in frontend applications, mobile apps, or browser code.
  • Rotate keys regularly: Delete compromised or unused keys and create new ones.
  • Use separate keys per environment: Create different keys (or workspaces) for development, testing, and production.