qwen dashscope api key

Not specified by the original author.

TL;DR

An international key goes with https://dashscope-intl.aliyuncs.com/compatible-mode and a Beijing key with https://dashscope.aliyuncs.com/compatible-mode.

The error

match the API key region to the base URL or get 401 Invalid API-key

Fix

1. An international key goes with https://dashscope-intl.aliyuncs.com/compatible-mode and a Beijing key with https://dashscope.aliyuncs.com/compatible-mode. Expected: you can confirm this matches your situation.

2. Re-run the original operation and confirm the error is gone. Expected: no error, normal output.

When to use

• You hit this exact error with DashScope.
• The symptom matches: match the API key region to the base URL or get 401 Invalid API-key.

When NOT to use

• A different error message from DashScope; the cause here is specific to this error.
• Unrelated DashScope issues (different feature, different failure).
• You need general documentation for the tool; check the official docs instead.

Compatibility

Reported against DashScope. Source: https://github.com/sadeghhp/33pol/blob/HEAD/docs/integrations.md.

Variant phrasings

match the API key region to the base URL or get 401 Invalid API-key

Why it happens

Alibaba Cloud Model Studio has separate regional endpoints. A key from one region used against another region's URL fails auth.

Edge cases

• If your error message differs even slightly, this is probably a different issue; search the exact text.
• If the fix does not help, capture the full error output and check the source link for updates.

Source

https://github.com/sadeghhp/33pol/blob/HEAD/docs/integrations.md

Source: Alibaba Cloud Model Studio has separate regional endpoints. A key from one region used against another region's URL fails auth.

Verified resolution: [sadeghhp/33pol docs]: an international key goes with https://dashscope-intl.aliyuncs.com/compatible-mode and a Beijing key with https://dashscope.aliyuncs.com/compatible-mode. Mismatching key and URL returns 401 Invalid API-key. In the OpenAI-compatible mode the base URL must be the compatible-mode URL, the API key is the sk-prefixed DashScope key, and the model id must match Model Studio model ids like qwen-plus, not Hugging Face paths. A generic Connection failed banner plus a detail like Output data may contain inappropriate content is content moderation (400 DataInspectionFailed), not a broken connection.

Source URL: https://github.com/sadeghhp/33pol/blob/HEAD/docs/integrations.md

Not specified by the original author.

Context: In Next.js apps that call Alibaba Cloud Model Studio (the LLM platform Alibaba also calls Bailian) through its OpenAI-compatible endpoint, the community convention is to keep the API key in a BAILIANAPIKEY variable inside .env.local, read only from server-side code. You create the key on the API-Key page of the Model Studio console. People search this when wiring Qwen/DashScope calls into a Ne

TL;DR: create the key in the Model Studio console, put BAILIANAPIKEY in .env.local (gitignored, server-side only), and read it via process.env.BAILIAN_API_KEY in route handlers. The OpenAI-compatible base URL is https://dashscope.aliyuncs.com/compatible-mode/v1.

1. Get a key - open the Alibaba Cloud Model Studio console (modelstudio.console.alibabacloud.com for international, or the Beijing console), and create an API key on the API-Key page. Keys are region-scoped, so the key must match the region of the endpoint you call.
2. Create .env.local in the project root with one variable per line in the standard env-file format (shown here with placeholders, never commit real values):

BAILIAN_API_KEY [your key]
BAILIAN_MODEL [model name, e.g. qwen3-max]

Success check: npm run dev starts with no key printed anywhere in the terminal or browser.

3. Read the key only in server code (route handlers, server actions), referencing process.env.BAILIAN_API_KEY where you build the client. Point your OpenAI client at the compatible-mode base URL with this key as the bearer credential. Success check: a chat completion request returns 200.
4. Add .env.local to .gitignore and never commit it. Never prefix the variable with NEXT_PUBLIC_, which would bundle the key into client JavaScript and expose it in the browser.

Why BAILIANAPIKEY is still undefined after editing .env.local

Most searches for "bailianapikey .env.local" are really "I added the key but process.env.BAILIAN_API_KEY is undefined". The format rules that fix the majority of cases:

• Write the line as BAILIAN_API_KEY [your key] with no quotes around the value. Quotes become part of the value, and auth fails with a key that looks right.
• No spaces around the equals sign and no export prefix. The file must be named exactly .env.local and live in the project root, not in src/.
• Restart the dev server after editing. Next.js reads env files once at startup, so a running next dev never picks up the new key. Success check: a route handler logging process.env.BAILIAN_API_KEY ? "set" : "missing" prints "set" (never log the key itself).
• .env.local overrides .env, .env.development, and .env.production. If another env file sets the same variable to a wrong value, .env.local still wins, so check the lower-precedence files when the value looks stale.

Variant phrasings: "bailian api key nextjs", "DASHSCOPEAPIKEY .env", "qwen api key environment variable", "model studio api key .env.local", "bailianapikey undefined nextjs".

Mechanism (after the fix): Next.js loads .env.local into process.env at startup. The OpenAI-compatible endpoint authenticates the key as a bearer token on each request. Alibaba's own docs also use the name DASHSCOPEAPIKEY; the two names are interchangeable as long as your code reads the same name you set. Separate key classes exist for the Qwen Code CLI plans (BAILIANCODINGPLANAPIKEY, BAILIANTOKENPLANAPIKEY) and are not interchangeable with standard keys.

Edge cases: a key from the wrong region returns an auth error even when the value is correct; sk-sp- prefixed coding-plan keys do not work against the standard endpoint; in production, prefer the hosting platform's env-var store (e.g. Vercel project env vars) over a committed file.

Use this when: a Next.js app (or any Node server) calls Model Studio / Bailian models through the OpenAI-compatible endpoint and needs the key in local development.

Do NOT use this when: the key is needed in client components (it will leak; proxy through a route handler instead), when deploying via a platform secret store (use that instead of a file), or for the Qwen Code CLI itself, which has its own auth flow and plan-specific key names.

In Next.js apps that call Alibaba Cloud Model Studio (the LLM platform Alibaba also calls Bailian) through its OpenAI-compatible endpoint, the community convention is to keep the API key in a BAILIANAPIKEY variable inside .env.local, read only from server-side code. You create the key on the API-Key page of the Model Studio console. People search this when wiring Qwen/DashScope calls into a Next.js route handler and want the key out of source control.

Verified resolution: TL;DR: create the key in the Model Studio console, put BAILIANAPIKEY in .env.local (gitignored, server-side only), and read it via process.env.BAILIAN_API_KEY in route handlers. The OpenAI-compatible base URL is https://dashscope.aliyuncs.com/compatible-mode/v1.

1. Get a key - open the Alibaba Cloud Model Studio console (modelstudio.console.alibabacloud.com for international, or the Beijing console), and create an API key on the API-Key page. Keys are region-scoped, so the key must match the region of the endpoint you call.
2. Create .env.local in the project root with one variable per line in the standard env-file format (shown here with placeholders, never commit real values):

BAILIAN_API_KEY [your key]
BAILIAN_MODEL [model name, e.g. qwen3-max]

Success check: npm run dev starts with no key printed anywhere in the terminal or browser.

3. Read the key only in server code (route handlers, server actions), referencing process.env.BAILIAN_API_KEY where you build the client. Point your OpenAI client at the compatible-mode base URL with this key as the bearer credential. Success check: a chat completion request returns 200.
4. Add .env.local to .gitignore and never commit it. Never prefix the variable with NEXT_PUBLIC_, which would bundle the key into client JavaScript and expose it in the browser.

Variant phrasings: "bailian api key nextjs", "DASHSCOPEAPIKEY .env", "qwen api key environment variable", "model studio api key .env.local".

Mechan

Source: https://github.com/qwenlm/qwen-code-docs/blob/HEAD/website/content/en/blog/quickstart/getting-started.mdx

Not specified by the original author.

Brave Search API auth: X-Subscription-Token header, not Bearer

TL;DR

Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - YOUR_KEY" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1. Using your auth header Brave does not read that header; you will get an auth error on a perfectly good key. Putting the key in ?apikey value or similar query params.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

2. Not supported, and it leaks the key into logs. 3. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Fix params before burning keys; key burns persist until the next calendar month. Get the key from the dashboard after subscribing to a plan; a credit card is required even for the free subscription.

Context: Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to your auth header an ?apikey value query parameter get auth failures on perfectly good keys.

Source: Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to your auth header an ?apikey value query parameter get auth failures on perfectly good keys.

Verified resolution: Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - YOUR_KEY" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1. Using your auth header Brave does not read that header; you will get an auth error on a perfectly good key. 2. Putting the key in ?apikey value or similar query params. Not supported, and it leaks the key into logs. 3. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Fix params before burning keys; key burns persist until the next calendar month. Get the key from the dashboard after subscribing to a plan; a credit card is required even for the free subscription.

Source URL: https://github.com/amal-david/docingest/blob/HEAD/server/storage/docs/api-dashboard.search.brave.com/documentation_2026-02-07T03:57:54.021Z.md