Skip to main content

Create an Application

An Open Platform application represents the identity of the caller. After the application is created, you obtain the application ID and Secret used to exchange for an access token. All subsequent API permissions are bound to this application.

Prerequisites​

  • Use an enterprise administrator account that has application management permissions.
  • Clearly identify the application owner, the usage environment, and the business resources to be accessed.
  • Confirm that your enterprise edition supports the API Open Platform. The free edition does not support this capability.
  • Prepare a key management service or a controlled runtime configuration to store the Secret.

Creation Steps​

  1. Log in to the Alibaba Mail admin console and navigate to Advanced Applications > API Open Platform.
  2. Click Add Application, then fill in the application name and description that can identify the caller.
  3. Select API permissions based on your business scope. For the initial configuration, only grant the permissions required for the current functionality.
  4. Save the application and record the Application ID (client_id or AppCode) and the Secret (client_secret).
  5. Exchange for an access token in the test environment and call a read-only API to verify connectivity.

Credential Management​

  • Store the Secret only in a key management service or a runtime Secret store. Do not write it into source code, container images, chat records, or logs.
  • Create separate applications for testing, staging, and production environments to avoid sharing credentials and permissions.
  • Record the application owner, the purpose of permissions, and the rotation schedule. Rotate immediately when the owner changes or when a credential is suspected of being compromised.
  • Logs should only contain the application identifier, request ID, API endpoint, and result. Do not log the Secret, access token, or email content.

Completion Check​

  • The application name can be mapped to the specific system and its owner.
  • The permission scope is consistent with current requirements, and no irrelevant write permissions have been granted for debugging convenience.
  • The Secret has been stored in a controlled configuration, and no plaintext copies exist in the repository or logs.
  • The test call uses the API Server in the correct region and returns the expected read-only data.

Source: Alibaba Mail User Manual, Alibaba Mail API Open Platform