Qwencloud Ops Auth

QwenCloud Authentication Setup

Configure and verify authentication for QwenCloud APIs. This skill is part of qwencloud/qwencloud-ai.

Skill directory

Use this skill's internal files for learning. Load references only when the user needs console or documentation links.

Security

NEVER output any API key, OSS credential in plaintext. This applies equally to DASHSCOPE_API_KEY and custom OSS AccessKey pairs. Any check or detection of credentials in this skill must be non-plaintext: report only status (e.g. "set" / "not set", "valid" / "invalid", HTTP status code), never the key value.

API Key Handling (MANDATORY)

When the API key is not configured or a script reports missing credentials:

1. NEVER ask the user to provide their API key directly. Do not prompt "please paste your API key" or similar. Do not request the key value in any form.
2. Help create a `.env` file with a placeholder, then instruct the user to fill in their own key:

• Run: echo 'DASHSCOPE_API_KEY=sk-your-key-here' >> .env
• Tell the user: "Please replace sk-your-key-here with your actual API key from the QwenCloud Console."

1. Or explain how to configure the environment variable: export DASHSCOPE_API_KEY='sk-...' + provide the console URL.
2. Only write the actual key value into .env if the user explicitly insists on having the agent do it for them.

Credential Priority Chain

Credentials are loaded in the following order (first match wins):

1. Environment variable — DASHSCOPE_API_KEY (or QWEN_API_KEY alias)
2. `.env` file — in current working directory, then repo root (detected via .git or skills/ directory). Existing environment variables are not overwritten.

Environment Variables

API Key Types

QwenCloud has three mutually exclusive key/plan types:

All qwencloud/qwencloud-ai scripts require a standard key (sk-). Coding Plan keys (sk-sp-) produce 401 invalid_api_key on standard endpoints. Token Plan keys (sk-sp-) are auto-routed to the Token Plan endpoint by scripts. Before a Token Plan request, fetch and read the current Token Plan model catalog and pass an exact listed model; if CDN access fails, use the local fallback. Coding Plan details remain in codingplan.md.

If the user's key starts with sk-sp-, first check tokenplan.md for Token Plan details and the CDN catalog above for model coverage, then codingplan.md for Coding Plan specifics. Guide them to obtain a standard key from the console below if needed for models outside their plan.

Viewing Bills

Use the qwencloud-usage skill to query usage, free tier quota, and billing directly. Alternatively, billing details are available in the QwenCloud console:

NEVER fabricate, guess, or construct usage/billing/console URLs. Only provide the exact links listed in this skill. If a URL is not listed here, do not invent one.

Getting an API Key

1. Open the QwenCloud Console
2. Sign in with your QwenCloud account
3. Create or copy an API key from the API Key management section
4. Standard keys start with sk- (not sk-sp- which is Coding Plan only)

Security Best Practices

• Never hardcode API keys in source code or config files committed to version control
• Use environment variables or .env files (and add .env to .gitignore)
• Rotate keys periodically and revoke compromised keys immediately
• Use least-privilege — create dedicated keys for specific applications when possible

Setting up .env

Create a .env file in your project root or current working directory:

echo 'DASHSCOPE_API_KEY=sk-your-key-here' >> .env

The script automatically loads .env from the current working directory and the project root (detected via .git or skills/ directory). Existing environment variables are not overwritten by .env values.

Example .gitignore entry

.env
.env.local
*.env

Verification

Unless explicitly stated otherwise, any script or task mentioned in this skill runs in the foreground — wait for standard output; do not run it as a background task.

PAYG only: Test authentication with a simple curl request. Token Plan: do not use curl; verify with the target skill's bundled Python script.

curl -sS -X POST "https://dashscope-intl.aliyuncs.com/compatible-mode/v1/chat/completions" \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"qwen-turbo","messages":[{"role":"user","content":"Hi"}]}'

A successful response returns JSON with choices and message.content.

Authentication Error Handling

QwenCloud API keys are scoped to the QwenCloud console. An invalid or mismatched key produces 401 Unauthorized.

When to trigger