Access credentials

Use access credentials to access MOI through an API, SDK, or CLI. On the Access credentials page, you can create personal access tokens and service accounts, grant product permissions to service accounts, and manage their credentials.

Access credentials identify the caller. Product permissions and workspace roles determine which products, models, workspaces, and resources the caller can access.

In the console, open the account menu in the upper-right corner and select Access credentials.

Choose a calling identity

  • Call as yourself: Use a personal access token. Requests use the current user’s permissions in the target product. This option is suitable for local development, personal scripts, CLI debugging, and BI direct connections.

  • Call as an application: Use a service account. A service account is an application identity independent of a personal account and requires its own product permissions. This option is suitable for backend applications, CI/CD, and long-running automation.

Supported products and access methods

Product

Services

API

SDK

CLI

Credentials

Genesis

Text generation, embeddings, and document reranking

Genesis API

OpenAI SDK
Anthropic SDK

—

Personal access token
Service-account API key

AI Studio

Manage resources in workspaces

AI Studio API

AI Studio SDK

AI Studio CLI

Personal access token
Client ID and Client Secret (service account)

  • Genesis

    • API Base URL: https://token.moi.matrixorigin.cn/v1

    • Model ID: Set the API request’s model field to this value. Copy it from the Genesis model marketplace, or call GET https://token.moi.matrixorigin.cn/v1/models to list the model IDs available to the current credential.

  • AI Studio

    • API Endpoint: https://api.moi.matrixorigin.cn/v5

    • Workspace: Operations on a workspace require its workspace ID and a corresponding workspace membership and role.

Service accounts and credentials

Use a service account for an application or automation. It does not inherit the creator’s personal permissions. When you create a service account, set the expiration of its initial Secret and add at least one product permission:

  • Genesis: Grant access to all models or selected models. You can also set quota and rate limits.

  • AI Studio: Select a workspace and assign the service account a role in that workspace.

A service account uses the following credentials:

  • Client ID and Client Secret: Use them together to obtain an access token through OAuth.

  • Genesis API Key: Use it directly to call Genesis models.

Set the expiration for each Secret and API Key separately. A service account can have up to 5 Secrets and 15 API Keys.

Use credentials securely

  • The page displays a complete token, Client Secret, or API Key only when you create or update it. Copy and store the value before closing the dialog.

  • Store credentials in server-side environment variables or a secret manager. Do not put them in source code, client-side code, logs, tickets, or screenshots.

  • If a credential is exposed, disable or delete it, create a new credential, and replace the old value stored by the application.

Further reading

Last updated on