$npx -y skills add QwenCloud/qwencloud-ai --skill qwencloud-ops-auth[QwenCloud] Configure authentication (API keys, endpoints). TRIGGER when: setting up QWEN_API_KEY, troubleshooting 401/auth errors, when another skill reports missing credentials, or user explicitly invokes this skill by name (e.g. use qwencloud-ops-auth). DO NOT TRIGGER when: no
| 1 | > **Agent setup**: If your agent doesn't auto-load skills (e.g. Claude Code), see [agent-compatibility.md](references/agent-compatibility.md) once per session. |
| 2 | |
| 3 | # QwenCloud Authentication Setup |
| 4 | |
| 5 | Configure and verify authentication for QwenCloud APIs. |
| 6 | This skill is part of **qwencloud/qwencloud-ai**. |
| 7 | |
| 8 | ## Skill directory |
| 9 | |
| 10 | Use this skill's internal files for learning. Load references only when the user needs console or documentation links. |
| 11 | |
| 12 | | Location | Purpose | |
| 13 | |----------|---------| |
| 14 | | `references/codingplan.md` | Coding Plan vs standard key: model list, endpoint mapping, error codes, cost risks | |
| 15 | | `references/custom-oss.md` | Custom OSS bucket setup for production file uploads (replaces 48h temp storage) | |
| 16 | | `references/sources.md` | Console URLs, auth guide (manual lookup only) | |
| 17 | | `references/agent-compatibility.md` | Agent self-check: register skills in project config for agents that don't auto-load | |
| 18 | |
| 19 | ## Security |
| 20 | |
| 21 | **NEVER output any API key, OSS credential in plaintext.** |
| 22 | This applies equally to `DASHSCOPE_API_KEY` and custom OSS AccessKey pairs. Any check or detection of credentials in this skill must be **non-plaintext**: report only status (e.g. "set" / "not set", "valid" / "invalid", HTTP status code), never the key value. |
| 23 | |
| 24 | ## API Key Handling (MANDATORY) |
| 25 | |
| 26 | When the API key is not configured or a script reports missing credentials: |
| 27 | |
| 28 | 1. **NEVER ask the user to provide their API key directly.** Do not prompt "please paste your API key" or similar. Do not request the key value in any form. |
| 29 | 2. **Help create a `.env` file** with a placeholder, then instruct the user to fill in their own key: |
| 30 | - Run: `echo 'DASHSCOPE_API_KEY=sk-your-key-here' >> .env` |
| 31 | - Tell the user: "Please replace `sk-your-key-here` with your actual API key from the [QwenCloud Console](https://home.qwencloud.com/api-keys)." |
| 32 | 3. **Or** explain how to configure the environment variable: `export DASHSCOPE_API_KEY='sk-...'` + provide the console URL. |
| 33 | 4. **Only** write the actual key value into `.env` if the user **explicitly insists** on having the agent do it for them. |
| 34 | |
| 35 | ## Credential Priority Chain |
| 36 | |
| 37 | Credentials are loaded in the following order (first match wins): |
| 38 | |
| 39 | 1. **Environment variable** — `DASHSCOPE_API_KEY` (or `QWEN_API_KEY` alias) |
| 40 | 2. **`.env` file** — in current working directory, then repo root (detected via `.git` or `skills/` directory). Existing environment variables are not overwritten. |
| 41 | |
| 42 | ### Environment Variables |
| 43 | |
| 44 | | Variable | Purpose | |
| 45 | |---------------------|-------------------------------------------------------------------------------------------------------------------------------------------| |
| 46 | | `DASHSCOPE_API_KEY` | API key (required) | |
| 47 | | `QWEN_API_KEY` | Alias for `DASHSCOPE_API_KEY`. If both are set, `QWEN_API_KEY` takes priority. | |
| 48 | | `QWEN_BASE_URL` | Override default endpoint (optional; for custom deployments) | |
| 49 | | `QWEN_TMP_OSS_BUCKET` | Custom OSS bucket for file uploads (replaces 48h temp storage). See [custom-oss.md](references/custom-oss.md). | |
| 50 | | `QWEN_TMP_OSS_REGION` | OSS region (required when `QWEN_TMP_OSS_BUCKET` is set). | |
| 51 | | `QWEN_TMP_OSS_AK_ID` / `AK_SECRET` | OSS credentials (use RAM user with least-privilege: `oss:PutObject` + `oss:GetObject`). Falls back to `OSS_ACCESS_KEY_ID` / `OSS_ACCESS_KEY_SECRET` if not set. | |
| 52 | |
| 53 | ## API Key Types |
| 54 | |
| 55 | QwenCloud has two mutually exclusive key types: |
| 56 | |
| 57 | | Key Type | Format | Purpose | Endpoint | |
| 58 | |----------|--------|---------|----------| |
| 59 | | **Standard (Pay-as-you-go)** | `sk-xxxxx` | API calls from scripts, apps, and tools | `dashscope-intl.aliyuncs.com` | |
| 60 | | **Coding Plan** | `sk-sp-xxxxx` | Interactive AI coding tools only (Cursor, Claude Code, Qwen Code) | `coding-intl.dashscope.aliyuncs.com` | |
| 61 | |
| 62 | All qwencloud/qwencloud-ai scripts require a **standard** key. Coding Plan keys cannot call QwenCloud APIs directly — they produce `403 invalid api-key` on standard endpoints. Coding Plan supports only 8 text LLMs (qwen3.5-plus, kimi-k2.5, glm-5, MiniMax-M2.5, qwen3-max-2026-01-23, qwen |