> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qwencloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create and manage API keys

## Overview

Every API request to QwenCloud requires an API key for authentication. The [API Keys](https://home.qwencloud.com/api-keys) page provides centralized management of all your access credentials, including pay-as-you-go API keys and Token Plan API keys.

- **Pay-as-you-go API keys**: Each key belongs to one region and one [workspace](/developer-guides/administration/workspace) in that region, and inherits the workspace's model access and [rate limits](/developer-guides/administration/rate-limits).
- **Token Plan API keys**: Displays the subscriber's access credentials for model API calls. Token Plan is available only in Singapore, and its keys are separate from pay-as-you-go keys. Seat assignment and member management are handled in the [Token Plan management portal](https://tokenplan-enterprise.qwencloud.com).

For a quick guide on getting your first API key, see [Get an API key](/api-reference/preparation/api-key).

## Create an API key

<Steps>
  <Step title="Select a region and workspace">
    Use the region selector in the upper-right corner of the console to select the region you will call. Then go to the [API Keys](https://home.qwencloud.com/api-keys) page and use the workspace switcher at the bottom of the sidebar to select the workspace where you want to create the key.
  </Step>

  <Step title="Create the key">
    Click **Create API key**. Enter a description to help you identify the key later (such as "Production API key for main application"), then click **Generate Key**.
  </Step>

  <Step title="Copy the key">
    Copy the API key immediately — **it is shown only once**. After you close the dialog, you can only see a masked version of the key.
  </Step>
</Steps>

Each workspace supports up to 20 API keys.

## Manage pay-as-you-go API keys

In the **Pay-As-You-Go** section of the [API Keys](https://home.qwencloud.com/api-keys) page, you can:

- **Search**: Find keys by description.
- **Edit**: Click **Edit** to update the key's description.
- **Delete**: Click **Delete** to permanently revoke the key. This action cannot be undone — all requests using this key will immediately fail.
- **Enable/Disable**: Toggle the status switch to enable or disable an API key. Disabled keys reject all requests; re-enabling restores access immediately.
- **View cost**: Click **View cost** to see the cost breakdown for a specific API key.

The API keys table shows each key's **ID**, **API Key** (masked), **Description**, **Created**, **Cost**, **Status**, and available **Actions**.

## Manage Token Plan API keys

In the **Token Plan** section of the [API Keys](https://home.qwencloud.com/api-keys) page, you can view your Token Plan credentials and Base URLs (OpenAI-compatible, Anthropic-compatible). Switch between the **Individual** and **Team** tabs to view the corresponding API keys. The table shows **API Key** (masked), **API Key Status**, **Plan**, **Days Remaining**, and **Actions** (Reset, Manage plan).

- **Reset**: Regenerate the API key. The old key is invalidated immediately.
- **Manage plan**: Navigate to the Token Plan management page to view subscription details and usage. For team edition seat assignment and member management, use the [Token Plan management portal](https://tokenplan-enterprise.qwencloud.com).

<Note>
  Full Token Plan management (seat assignment, SSO login, member management) is available in the [Token Plan management portal](https://tokenplan-enterprise.qwencloud.com). See [Team management](/token-plan/team/team-management) for details.
</Note>

## API keys and workspaces

API keys are scoped to the workspace where they are created:

- Keys in the **default workspace** can call all available models with account-level rate limits.
- Keys in a **sub-workspace** can only call models that have been granted to that workspace, with the rate limits configured for that workspace.

To manage API keys for a different workspace, switch to it using the workspace switcher at the bottom of the sidebar.

## API keys and regions

API key management is available in all six regions. Keys are created per region:

- A pay-as-you-go key works only with the endpoint of the region where it was created (`{region}.maas.qwencloudapi.com`) and with its workspace. Calling another region's endpoint with it returns an authentication error.
- The **API Keys** page lists only the keys of the current region and workspace. To view or create keys in another region, switch the region in the upper-right corner of the console, then select the workspace.
- Switching regions does not copy or delete keys. Keys created in another region reappear when you switch back.
- Token Plan keys are separate from pay-as-you-go keys and work only with the Token Plan endpoint (`token-plan.maas.qwencloudapi.com`).

See [Regions and endpoints](/developer-guides/getting-started/regions).

## API keys and billing

Pay-as-you-go API keys and Token Plan API keys must be used with their respective endpoints. Do not mix them.

<Note>
  API calls via DashScope endpoints use pay-as-you-go billing and will not consume your Token Plan subscription quota.
</Note>

## Security best practices

- **Store keys securely**: Use environment variables or a secrets manager. Never hardcode API keys in source code.
- **Don't expose keys client-side**: API keys should only be used in server-side code. Never include them in frontend applications, mobile apps, or browser code.
- **Rotate keys regularly**: Delete compromised or unused keys and create new ones.
- **Use separate keys per environment**: Create different keys (or workspaces) for development, testing, and production.