API Key Inbound Authentication Practice

Step 1: Create an ALB Extensible Edition instance

1. Log on to the ALB console, select the China (Ulanqab) region, and then click Create ALB.

2. On the purchase page, complete the following configurations and click Create Now.

   • Region: Select China (Ulanqab).

   • Network Type: Select Internet-facing.

   • VPC and Zone: Select the target VPC. Select the checkboxes for Ulanqab Zone A and Ulanqab Zone B, select the corresponding vSwitch for each zone, and then select Automatically Assign EIP.

   • IP Version: Select IPv4.

   • Edition (Instance Fee): Select Extensible Edition.

3. On the Confirm Order page, confirm the instance configuration details and click Activate Now.

Step 2: Create an AI Service-type server group

Create an AI Service-type server group to connect to Alibaba Cloud Model Studio.

1. In the Server Group console, click Create Server Group. Set Server Group Type to AI Service, enter a name such as sgp-ai-qwen, and then click Create.

2. In the The server group is created dialog box, click Add Backend Server.

3. In the Add AI Service dialog box, complete the following configurations and click OK.

   • Model provider: Select Alibaba Cloud Model Studio.

   • Endpoint: This parameter is automatically populated after selecting a Model provider.

   • Identity Credential: Select the identity credential that you created for the Alibaba Cloud Model Studio API key.

Step 3: Create a listener

1. In the ALB console, click the ID of the target instance to open the Instance Details page. On the Listener tab, click Create Listener.

2. In the Configure Listener step, set Listener Protocol to HTTPS and Listener Port to 443. Then, click Next.

3. In the Configure SSL Certificate step, select the server certificate that matches your custom domain name and click Next.

4. In the Select Server Group step, select the AI Service type and then the sgp-ai-qwen server group. Then, click Next.

   The server group that you select becomes the listener's default rule. This rule processes requests that do not match any other forwarding rules. You can change this setting.

5. In the Configuration Review step, review the settings and click Submit.

Step 4: Create a service extension

Create a service extension with the API key authentication component to extract and validate the API key from an HTTP header.

1. In the Service Extension console, click Create Service Extension. In the Service Extension Configuration section, enter a Extension name, such as ext-apikey-auth.

2. Keep Extension Type as the default Plug-in. From the Component name drop-down list, select API Key Authentication. Configure the authentication policy and click Create.

   • Credential Source: Keep the default value, Authorization:Bearer<token>.

     The <token> is a placeholder for the API key that a client includes in the request after Authorization: Bearer. ALB extracts and validates the API key from this location.

   • Generation Method: Keep the default value, System.

   • Timeout and Processing policy: This topic uses the default values 1000 and Terminate. You can modify the values.

   The Credential Source parameter supports multiple methods, such as the default Authorization:Bearer<token>, Custom HTTP header, Custom Query String, or Custom Cookie parameter. You can select a method.

   The System method automatically generates an API key credential. After creating the service extension, you can view and copy the credential on its Details page. You can also select the Custom method to manually enter an API key.

Step 5: Configure a forwarding rule

Create a forwarding rule for the listener, add an HTTP header condition, and associate the service extension with the rule.

1. In the ALB console, click the ID of the target instance to open the Instance Details page. On the Listener tab, click the ID of the target listener to open the Listener Details page, and then navigate to the Forwarding Rules tab.

2. Click Add New Rule, complete the following configurations, and then click OK.

   • Add Condition: Select HTTP Header. Then, set Key k and Value v.

     The key-value pair k: v is for demonstration purposes. In a production environment, you can configure HTTP header key-value pairs or use other types of forwarding conditions.

   • Service Extension (Optional): Keep the default Use Existing Service Extension option and select ext-apikey-auth from the drop-down list.

   • Action: Select Forward To and then select the AI Service-type server group sgp-ai-qwen.

After the forwarding rule is created, requests containing the HTTP header k: v match this rule. The service extension extracts the <token> from the Authorization header and validates it as the API key. If authentication succeeds, the request is forwarded to the sgp-ai-qwen server group.

Step 6: Configure DNS resolution

Add a CNAME record to point your custom domain name to the DNS name of the ALB instance so that clients can access ALB through your domain name.

The following example uses Alibaba Cloud DNS. If your domain name is not registered with Alibaba Cloud, you must first add the domain name to the Alibaba Cloud DNS console.

1. In the ALB console, copy the Domain Name of the target instance.

2. Log on to the Alibaba Cloud DNS console. Find the target domain name and click Settings in the Actions column. On the Settings page, click Add Record.

3. Add a CNAME record with the following information and click OK.

   • Record Type: Select CNAME.

   • Hostname: Enter a prefix for the domain name, such as ai. For example, if your root domain is example.com, the full domain name for accessing ALB is ai.example.com.

   • Query Source and TTL: Keep the default values.

   • Record Value: Enter the Domain Name of the ALB instance.

4. In the Change Resource Record Confirmation dialog box, verify the information and click OK.

Step 7: Test and verify

Send a curl request to verify API key authentication. The request must meet the following conditions:

• Include the rule-matching header: The request must include the k: v header to match the forwarding rule with which the service extension is associated.

• Comply with the OpenAI-compatible protocol: The request path must be /v1/completions, /v1/chat/completions, or /v1/embeddings, and the overall format must comply with the protocol.

The domain name ai.example.com in the following test commands is an example. When you perform the test, replace it with the actual domain name that you configured in Step 6. Make sure that the DNS resolution has taken effect.

curl -v \
    -H "k: v" \
    -H "Authorization: Bearer <token>" \
    -H "Content-Type: application/json" \
    -d '{
        "model": "qwen-turbo",
        "messages": [
            {
                "role": "user", 
                "content": "Who are you"
            }
        ]
    }' \
    https://ai.example.com/v1/chat/completions

{
    "choices": [
        {
            "message": {
                "role": "assistant",
                "content": "Hello! I am Qwen, a large language model developed by the Tongyi Lab of Alibaba Group..."
            },
            "finish_reason": "stop",
            "index": 0
        }
    ],
    "object": "chat.completion",
    "usage": {
        "prompt_tokens": 14,
        "completion_tokens": 53,
        "total_tokens": 67
    },
    "model": "qwen-turbo"
}

curl -v \
    -H "k: v" \
    -H "Authorization: Bearer wrong-api-key" \
    -H "Content-Type: application/json" \
    -d '{
        "model": "qwen-turbo",
        "messages": [
            {
                "role": "user", 
                "content": "Who are you"
            }
        ]
    }' \
    https://ai.example.com/v1/chat/completions

curl -v \
    -H "k: v" \
    -H "Content-Type: application/json" \
    -d '{
        "model": "qwen-turbo",
        "messages": [
            {
                "role": "user", 
                "content": "Who are you"
            }
        ]
    }' \
    https://ai.example.com/v1/chat/completions

HTTP/2 401 
content-length: 29
content-type: text/plain
date: Wed, 21 Jan 2026 05:58:31 GMT

Client authentication failed

Billing

• ALB Extensible Edition: This edition is in public preview and is free of charge.

• Public network access fees: An Internet NAT Gateway incurs instance fees and Capacity Unit (CU) fees. EIPs associated with the NAT Gateway and the ALB Extensible Edition instance have separate billing rules, and the fees are charged by EIP.

• Domain name and DNS resolution fees: In addition to the domain name fee from your provider, you must pay public authoritative DNS resolution fees if you configure DNS resolution on Alibaba Cloud.

• Certificate fees: You are charged server certificate fees if you purchase a certificate from Alibaba Cloud or upload one to Alibaba Cloud.

• Alibaba Cloud Model Studio fees: You are charged for calling Alibaba Cloud Model Studio APIs.

Regions that support ALB Extensible Edition

Recommendations

• API key management: Rotate API keys regularly. Avoid using the same credential for extended periods. If you use the system-generated method, securely store the generated API key to prevent leaks.

• Credential source selection: Choose a credential source that meets your requirements. The default Authorization:Bearer<token> method is compatible with the OpenAI protocol and suitable for most scenarios. If you require a custom configuration, we recommend using the Custom HTTP header or Custom Query String method to avoid exposing the API key in the URL.

FAQ