Skip to main content

Authentication

Create and use an API key.

The DashScope RAG API authenticates with an API key. Pass the key in the Authorization header on every request — the platform uses it to route the call to your workspace automatically.

Get an API key

1

Open the Model Studio console

Go to the RAG Console and sign in with your Alibaba Cloud account.
2

Create an API key

Click API Key in the left navigation, then create a new key or copy an existing one.
An API key has account-level permissions. Keep it private — don't share it publicly or commit it to a code repository.

Use the API key

Pass the key in the Authorization header on every request: 
Authorization: Bearer sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Full example: 
curl https://{workspaceId}.cn-beijing.maas.aliyuncs.com/api/v1/indices/rag/index/list?page_number=1&page_size=10 \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY"

Permissions

  • Alibaba Cloud main account — can call every endpoint directly.
  • RAM sub-account — needs the AliyunBailianDataFullAccess policy and must be added to the target workspace.
  • An API key's scope is configured in the Model Studio console.

Security recommendations

  • Keep keys out of the repo — store the API key in an environment variable such as DASHSCOPE_API_KEY.
  • Split by application — use a separate API key per application so you can track and revoke them independently.
  • Rotate regularly — replace your API keys on a schedule to limit the impact of a leak.
With your credentials in hand, try calling List Knowledge Bases.
General
Knowledge Base
Documents
Chunks
Sync Jobs
Data Import
Knowledge Search & Chat
Agent Management