Create a pay-as-you-go Model Studio API key with the workspace and host your application will use. Verify the compatible endpoint, access scope and spending controls before expanding the workload.

Before you start

Model Studio distinguishes ordinary pay-as-you-go credentials from dedicated Token Plan or Coding Plan keys. Official documentation.

Identify which API service the application is intended to use before creating the secret. Copying a credential from a different service plan into a familiar client does not establish that the endpoint and billing path match. Keep the intended service in the setup record.

Confirm the workspace, account role and target model. If the operator cannot access key creation, resolve the relevant page or workspace permission through the account owner. Do not use an unrelated administrator’s shared secret simply to bypass an unclear ownership decision.

Choose the smallest first task whose result can be verified. Keep billing and usage visibility available to the person running it, and define what should stop the experiment. That preparation makes the credential a controlled application component rather than an unowned account capability.

Step-by-step: create the key

  1. Open the official Model Studio API-key page and select the intended service scope and workspace.
  2. Choose Create API Key and enter a description that identifies the application purpose.
  3. Inspect Custom permissions when appropriate, including model access and the application’s actual network egress.
  4. Create the key, then copy the one-time secret and displayed API Host directly into protected configuration.

The creation dialog displays the complete secret and host; after closing it, plaintext cannot be retrieved through the ordinary view. Official documentation.

Preserve the host exactly as documented for the request interface. A service host and a compatible-mode base URL are related configuration values, but the required path still matters. Use the current quickstart to choose the correct compatible-mode path rather than concatenating a guessed URL.

The image checklist for this guide requires real console captures with secrets and identifiers removed. Capture each step individually, including the actual model-access controls and rotation action. A missing capture remains pending; an invented console would not verify your setup.

Set a spending limit / budget alerts

Model Studio’s billing guidance describes spending and notification controls that should be inspected with the account’s usage view. Official documentation.

Read the behavior of the control you enable. Distinguish a notification from a setting that actually rejects further work, and keep the application’s own attempt and job bounds. A usage dashboard can lag behind a fast worker, so the application should not depend solely on a person noticing a chart.

For an eligible model, Free Quota Only can stop requests when the available free quota is exhausted. Official documentation.

Use that option deliberately for a free-only experiment where supported. Record its current console behavior before enabling it, including whether it can be changed immediately. Do not turn it off merely to make a failing request succeed unless the paid continuation is the intended operating choice.

Verify the key: first call with cURL and Python

curl "$DASHSCOPE_BASE_URL/chat/completions" --max-time 60 -H "Authorization: Bearer $DASHSCOPE_API_KEY" -H "Content-Type: application/json" -d '{"model":"qwen3.8-max","messages":[{"role":"user","content":"Hello"}],"max_tokens":512}'
import os
import sys
from openai import OpenAI, APIStatusError

model = os.environ.get("DASHSCOPE_MODEL", "qwen3.8-max")
if "--bad-model" in sys.argv:
    model = "ai-api-hub-invalid-model"
# Copy the compatible-mode Base URL for your workspace from Model Studio.
base_url = os.environ["DASHSCOPE_BASE_URL"].rstrip("/")
client = OpenAI(
    api_key=os.environ["DASHSCOPE_API_KEY"],
    base_url=base_url,
    timeout=60.0,
    max_retries=0,
)
try:
    result = client.chat.completions.create(
        model=model,
        messages=[{"role":"user","content":"Explain why an extracted field should retain its source in one sentence."}],
        max_tokens=512,
    )
    print(result.choices[0].message.content)
    print("finish_reason:", result.choices[0].finish_reason)
    print(result.usage.model_dump_json() if result.usage else "Usage unavailable")
except APIStatusError as exc:
    print(f"HTTP {exc.status_code}")
    print(exc.response.text)
    raise SystemExit(1)
finally:
    client.close()

DASHSCOPE_BASE_URL must contain the actual compatible-mode URL copied for your workspace, without a trailing slash for the shown cURL command. The script normalizes a trailing slash itself. No workspace identifier is invented in this example.

The following result is schematic and was not captured from an inference request. Your actual run supplies its own message, completion details and usage.

{"choices":[{"message":{"role":"assistant","content":"Example answer"},"finish_reason":"stop"}],"usage":{"prompt_tokens":14,"completion_tokens":18,"total_tokens":32}}

Run the smallest call from the process environment that will own the application. Inspect the completion state and usage after a response arrives. If the process fails before a response, identify the missing variable, client package or connection stage before changing provider settings.

Where to put the key

Store DASHSCOPE_API_KEY and DASHSCOPE_BASE_URL in protected server-side configuration. Keep the credential value out of source code, browser bundles and copied error transcripts. The base URL also belongs in controlled application configuration because a wrong host can send the request to an unintended service path.

Check how the service manager loads environment variables. A terminal can have the correct value while the deployed worker retains an older configuration. Restart or reload the appropriate process after a secret update according to your deployment procedure, then verify the safe request from that launch path.

The Qwen Python tutorial includes the complete request and deliberate failure branch. Preserve the model and interface along with the secret’s workspace owner.

Common rejections

For invalid-key errors, inspect the environment variable name and the matching service host. For access denial, inspect workspace permission and custom model or network scope. For a free-quota stop, inspect the intended offer boundary. These diagnoses should not all trigger a new credential.

Use Model Studio errors to retain the exact code and message. Check account capacity when the response identifies throttling rather than authentication.

Rotate and revoke

Where reset is supported, it creates a new secret and invalidates the old value immediately; the available key actions depend on the service scope. Official documentation.

Choose a replacement workflow that fits the application’s continuity requirement. Deploy a new credential to all consumers, verify it from the actual launch paths and then retire the old key. If using an immediate reset, plan the coordinated configuration update so workers do not continue with the invalidated value.

Keep the creator’s account lifecycle in the operating record. Before changing a service user’s access, identify the legitimate jobs that depend on its credentials and move ownership deliberately. For an exposure, revoke promptly and inspect usage while preserving only safe incident metadata.

Use the AI API cost calculator to turn the model and workload you are considering into an estimate.

Last verified · Source ↗

Frequently asked questions

Can I mix a dedicated plan key with any Model Studio endpoint?
No. Match the credential type, service path and intended billing arrangement.
Where does the compatible-mode URL come from?
The current workspace access configuration and official quickstart, using the API Host provided by the console.
Can I view the whole key after closing its creation dialog?
The current guide says the ordinary plaintext view is no longer available; save the secret securely when created.
What does a reset do to the old key?
Where supported, it invalidates the old value immediately.
Does a spending alert always stop API requests?
Inspect the specific control’s enforcement behavior; do not assume a notification is a hard stop.
Should a free-quota rejection lead to disabling the stop setting automatically?
No. Continue on a paid basis only when that is the intended operating choice.

Sources

Last verified · Source ↗