Application Load Balancer (ALB) Extensible Edition Credential Management allows you to centrally create and manage outbound credentials, which are securely stored using KMS encryption. When adding a backend service, you can simply reference these pre-configured credentials. ALB then automatically includes them when forwarding requests to authenticate with the backend service.
Note: Credential Management handles outbound authentication (ALB to backend services). For inbound authentication (clients to ALB), use the API key authentication component or JWT authentication component from the component library.
Prerequisites
Before you begin, make sure that you have:
An ALB Extensible Edition instance. ALB Extensible Edition is currently in public preview. For more information, see Public preview of ALB Extensible Edition.
(Optional) A KMS instance and primary key if you want to use KMS-managed encryption
Configure credential management
Step 1: Create a credential
When you use Credential Management for the first time, the system automatically creates the AliyunServiceRoleForAlbAccessKMS service-linked role to authorize ALB to access KMS.
Go to ALB console - Credential Management page and select the region where your server group is located.
Click Create Credential.
Configure the following parameters:
Parameter
Description
Credential Type
Default is API Key. Enter your API key. To use the AccessKey type (Alibaba Cloud AK/SK format only), contact your account manager.
Credential Management
Select an encryption method:
Default Encryption: Uses system-managed keys. Free. Suitable for most scenarios.
KMS-Managed: Uses your own KMS keys. Suitable when you need full control over key lifecycle. Incurs KMS charges. Requires selecting a KMS instance that has at least one available secret, and master key.
Click Create.
The credential appears in the Credential Management list.
Step 2: Reference the credential in backend services
Associate credentials with specific backend services. ALB automatically includes credentials in requests to those services.
Go to ALB console - Server Groups page and click the target MCP server group ID to open the details page.
Click the Backend Servers tab and click Add MCP Service.
Configure the service:
Service Type: Select REST API.
OpenAPI Configuration: Enter the backend service API information.
In the Outbound Authentication section, configure the credential:
Setting
Description
Authentication Method
Select API Key, then choose a credential from the dropdown list.
Credential Location (expand Advanced Settings)
Specify how to pass the credential:
HTTP Header (default): Adds the credential to HTTP headers. Customize Credential Parameter Name (default:
Authorization) and Credential Prefix (default:Bearer).Query String: Adds the credential to URL query parameters. Customize Credential Parameter Name.
Click OK.
Result: ALB automatically includes the specified credential in all requests to the backend service. The backend service validates the credential to verify the request source.
Step 3: Manage credentials
After creating credentials, manage them in ALB console - Credential Management page:
Modify: Update credential data or encryption method.
Delete: Remove credentials that are no longer needed. Remove all references before deletion.
Note: When you update credential data, all backend services that reference the credential immediately use the new credential. No additional action is required.
Billing
Item | Billing rule |
Public preview | ALB Extended Edition instances and Credential Management are free. Internet data transfer charges apply if your services use public network access. |
After general availability | Standard pricing applies. Pricing details will be announced. |
KMS-managed credentials | Incurs KMS service charges. For more information, see Billing. |
Quotas
Quota | Description | Default value |
alb_quota_identities_num | Maximum number of credentials per region | 100 |
To increase quotas, contact your account manager.
FAQ
What's the difference between Credential Management and authentication components?
Credential Management (this feature): Manages outbound authentication—credentials that ALB sends to backend services.
Authentication components (API key, JWT): Manage inbound authentication—credentials that clients send to ALB.
Example flow:
Client → ALB: API key authentication component validates the client's credentials.
ALB → Backend: Credential Management provides ALB's credentials to the backend.