Managing API Keys

Constraints

• Each account can have up to 30 API keys. If you exceed this limit, delete old keys before adding new ones.
• After you create an API key, you must save it right away. The system does not store the key as plain text. The key cannot be recovered if lost.
• After you delete an API key, it becomes invalid right away.

Creating an API Key

You can create up to 30 API keys. An API key is displayed only once after being created. Copy and keep it secure. If the key is lost, create a new API key.

1. Log in to the MaaS console and select the target region on the top navigation bar.
2. In the navigation pane, choose Management and Statistics > API Key Management .
3. On the API Key Management page, click Create API Key, configure the basic information and permission settings, and click OK.

   The tag cannot be modified after the key is created.

   Table 1 Parameters

   Parameter		Description
   Basic information	Tag	Tag of the API key. The tag must be unique. The tag can contain 1 to 100 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.
   	Description	Description of the custom API key. The value can contain 1 to 100 characters.
   Permission Settings	Scope of Authority	You can select All (unrestricted access to all resources) or Customize (access to specified resources). The default value is All.
   	IP Address Whitelist	This parameter can be configured when Scope of Authority is set to Customize. After this function is enabled, only IP addresses in the whitelist can be used to call model services. IPv4 CIDR blocks are supported. Enter an IPv4 CIDR block and press Enter. A maximum of 100 addresses can be entered. IPv4 example: 192.168.1.1 192.168.1.10-192.168.1.100 192.168.10.0/24 Figure 1 IP address whitelist
   	Model Service Access Scope	This parameter can be configured when Scope of Authority is set to Customize. You can select Built-in Services or Endpoint. Built-in Services: The API key restricts access to selected models and versions when making calls using the model parameter. The system automatically includes all current and future built-in services and their versions. Choose specific ones if needed. Endpoint: The system automatically includes all current and future endpoints. Choose specific ones if needed. For details about how to create an endpoint, see Creating an Endpoint.

4. In the displayed dialog box, read the message carefully, copy the key and save it to a secure location, and click Saved. Confirm and Close.
   Figure 2 Saving an API key
   

   After you close the dialog box, the key cannot be viewed again. Once you create the API key, it appears on the API Key Management page. The system shows only the first and last four characters by default.

   Figure 3 API key
   

Editing an API Key

Once an API key is created, its tag cannot be modified. You can adjust other settings as needed. Modifying the permission may cause authentication failures for some model services and endpoints. Confirm the impact before performing the operation.

1. Log in to the MaaS console and select the target region on the top navigation bar.
2. In the navigation pane, choose Management and Statistics > API Key Management.
3. In the Operation column of the target API key, click Edit.
4. In the displayed dialog box, modify the basic information and permission settings as required, and click OK.

   For details, see Table 1.

5. In the Edit API Key dialog box, enter YES and click OK.

   After an API key is updated, changes will take effect in 5 minutes.

Managing API Key Operation Permissions of IAM Users

If the administrator does not configure the API key operation permissions for IAM users, MaaS determines whether IAM users have such permissions based on strict authorization of the ModelArts console.

To view or modify strict authorization, follow these steps:

1. Log in to the ModelArts console as an administrator. In the navigation pane of the old console, choose System Management > Permission Management.

   

   

   If you are using the new console, click Old Version.

   

2. Enable or disable strict authorization as required on the permissions management page.
   • Enabling strict authorization: IAM users who are not configured with the API key operation permissions do not have the API key management permissions. For details about how to configure the API key operation permissions for IAM users, see the following sections.
   • Disabling strict authorization: IAM users who are not configured with the API key operation permissions have the API key management permissions.
   Figure 4 Strict authorization
   

If the administrator configures the API key operation permissions for IAM users on the IAM console, MaaS determines whether IAM users have such permissions based on the administrator's permission configuration and strict authorization of the ModelArts console.

To configure the API key operation permissions for IAM users, follow these steps:

1. Create a custom policy.
   1. Log in to the IAM console as an administrator. In the navigation pane, choose Permissions > Policies/Roles.
   2. On the Policies/Roles page, click Create Custom Policy in the upper right corner.
   3. On the Create Custom Policy page, configure parameters based on the table below and click OK.

      Table 2 Parameters for creating a custom policy

      Parameter	Description
      Policy Name	Enter a policy name. Only letters, digits, spaces, and special characters (-_.,) are allowed.
      Policy View	Click Visual editor.
      Policy Content	Configure the API key permission for IAM users. Select Allow or Deny. Allow: The user is allowed to perform operations on cloud services. Deny: The user is not allowed to perform operations on cloud services. Select a cloud service, enter ModelArts in the search box, and select ModelArts Service (ModelArts). Figure 5 Selecting a cloud service Select an operation, enter apikey in the search box, and select the API key operation permissions for the IAM user as required. modelarts:apikey:delete: After this permission is granted, IAM users can delete API keys. modelarts:apikey:create: After this permission is granted, IAM users can create or edit API keys. Figure 6 Operation configuration
      Description	Enter a policy description.
      Scope	Retain the default setting (project-level service).

2. Add the custom policy to the target user group.

   If you need to create a user group, see Creating a User Group and Assigning Permissions.

   1. Log in to the IAM console as an administrator. In the navigation pane, choose User Groups.
   2. On the User Groups page, click Authorize in the Operation column of the target user group.
      Figure 7 Authorize
      
   3. On the displayed page, select the policy created in step 1, click Next, select the authorization scope as required, and click OK.
      Figure 8 Authorization page
      
3. Add the IAM user to the user group.

   For details about how to create an IAM user, see Creating an IAM User and Logging In.

   1. Log in to the IAM console as an administrator. In the navigation pane, choose User Groups.
   2. On the User Groups page, click Manage User in the Operation column of the user group modified in step 2.
   3. In the Manage User dialog box, select the target IAM user and click OK.

      After an IAM user is granted required permissions, the IAM user can use the permissions selected in step 1 on the API Key Management page of the MaaS console.

Deleting an API Key

If you reach the API key limit or if a key is leaked or lost, delete unused API keys. Deleting the API key will permanently remove it and prevent its use or retrieval. Exercise caution when performing this operation.

1. Log in to the MaaS console and select the target region on the top navigation bar.
2. In the navigation pane, choose Management and Statistics > API Key Management .
3. Click Delete on the right of the target API key.
4. In the Delete API Key dialog box, click OK.

FAQs

1. How long does it take for an API key to become valid after it is created?

   An API key becomes valid a few minutes after creation.

2. Can I use an API key across regions?

   API keys work only in their specific region. For example, an API key created in the CN-Hong Kong region can only be used in this region.