Account and security
This topic answers common questions about account and security for Alibaba Cloud Optical Character Recognition (OCR).
Can I configure an IP whitelist?
OCR is an API service and does not currently support IP whitelists. You can call the service from your own server. If you are concerned about your AccessKey being compromised, consider creating a RAM role and using temporary credentials from the Security Token Service (STS) to call the service.
Is data transmitted to OCR encrypted?
Yes, data is encrypted in transit. Alibaba Cloud OCR uses the standard Alibaba Cloud gateway, which provides end-to-end security for your data.
If your data has strict sensitivity requirements, consider a private deployment. The Alibaba Cloud OCR service supports both private deployment and offline SDK options to provide enhanced security.
Is image data stored?
The public cloud service for Optical Character Recognition (OCR) is stateless. The service does not store your original images, which are deleted immediately after the recognition result is returned. For more details, see the Alibaba Cloud Service Agreement.
How to grant RAM account permissions?
To call the service, the RAM account must have the AliyunOCRFullAccess permission.
What should I do if a RAM user with AliyunOCRFullAccess still gets a permission error when uploading images?
This issue typically occurs because the OCR demo page and OCR API calls use different access models. You must distinguish between the two scenarios:
The OCR demo page (duguang.aliyun.com) does not support RAM users. Only Alibaba Cloud accounts can use the demo page for free trials.
To use OCR as a RAM user, the Alibaba Cloud account must first activate the API service. After activation, a RAM user with the AliyunOCRFullAccess policy can make API calls and use the free quota.
How to resolve image upload errors?
Ensure that the image is accessible from the public network.
How to resolve the InvalidAccessKeyId.Inactive error?
This error indicates that the RAM user key you are using is disabled. Enable the key or replace it with a new one. To check the status of the key and enable it, go to Resource Access Management > User Details > AccessKey.
How do I distinguish the number of OCR API calls made by different RAM users?
Each RAM user should call the OCR service with an independent AccessKey ID. The system counts API calls based on the AccessKey ID.
To view the call volume, go to the Data Monitoring page in the OCR console: OCR Console > Data Monitoring.
To distinguish calls made by different RAM users:
Export the billing data.
Filter the records by AccessKey ID.
Match each AccessKey ID to the corresponding RAM user.
Call records do not directly display the RAM username. You must maintain the mapping between AccessKey IDs and RAM users.