Skip to main content

Permissions and usage policy

Token Plan purchase and subscription permissions, RAM user authorization, usage scope, API key rules, and data usage policy.

Purchase and subscription

  • Primary accounts can purchase Token Plan directly.
  • RAM users can purchase Token Plan, manage subscriptions, or use models only after authorization by the primary account.
  • Each verified identity is limited to one Personal Edition subscription and one Team Edition subscription; both can be purchased at the same time. Team Edition supports multiple seats.

RAM user authorization

Before a RAM user can use Token Plan, the primary account must complete the following authorization:
  1. Token Plan permissions: Grant AliyunTokenPlanReadOnlyAccess (read-only) or AliyunTokenPlanFullAccess (management).
  2. Billing Management permissions: Grant AliyunBSSReadOnlyAccess (read-only) or AliyunBSSFullAccess (management).
  3. Model Studio console permissions: On the Account Management page, assign the Administrator or Subscribe Plan permission to the RAM user.
RAM users do not need to complete identity verification separately. As long as the primary account has completed identity verification and has assigned usage permissions to the RAM user, the RAM user can use Token Plan normally.
If Billing Management permissions are missing, the My Subscriptions page may appear empty after the RAM user signs in.

Plan usage scope

Token Plan is for interactive use only in coding tools and agent tools (such as Claude Code, Cursor, Qwen Code, Qoder, and OpenClaw), and must not be used for automation scripts, custom application backends, or any non-interactive batch call scenarios. Models are integrated through the tools' extension mechanisms (Skill, Slash Command, or Agent); calls initiated interactively within a tool are considered normal use. Using a Token Plan API key for calls outside the allowed scope may be considered a violation or abuse and may result in subscription suspension or API key banning.

API key usage rules

  • Token Plan API key: Starts with sk-sp-, is used only for Token Plan model calls, and is displayed in full only once when generated.
  • Personal Edition devices: The same API key can be configured on multiple devices you own (such as your home and office computers), but only for your own use.
  • No sharing: API keys are for the subscriber's own use only and must not be shared or publicly disclosed. Sharing an API key with others may be considered a violation and may result in a ban.

Data usage policy

EditionData usage rules
Personal EditionData usage is governed by the service agreement. For details, see Related agreements.
Team EditionConversation data is not used for model training.

FAQ

Yes. Primary accounts can purchase directly; RAM users must first be authorized by the primary account with Token Plan permissions, Billing Management permissions, and Account Management permissions.
A RAM user needs the Token Plan system policy, Billing Management permissions, and Account Management permissions in the Model Studio console. For the specific policies, see "RAM user authorization" above.
This is usually because the RAM user lacks Billing Management permissions. Grant AliyunBSSReadOnlyAccess (read-only) or AliyunBSSFullAccess (management).
Yes, after authorization by the primary account. RAM authorization determines management permissions only; actual model calls also require the corresponding Token Plan API key.