White-label Mode

Applicable Scenarios

Provide AI development environments for employees or external users. Users do NOT need Tencent Cloud accounts, nor do they need to directly log in to the Tencent Cloud console — they only interact with the enterprise/platform's own domain, with zero awareness of Tencent Cloud. Can integrate with existing SSO/LDAP systems or self-owned account systems to achieve unified login. Supports a massive number of users with horizontal scaling capability, suitable for medium-to-large enterprises and ToC products.

Core problem this solves: Your users only interact with your product — they have no awareness that Tencent Cloud powers it underneath. Each user gets a fully isolated CloudBase environment. Your platform manages environments and credentials centrally, entirely transparent to users.

Onboarding Flow

White-label mode onboarding has two steps:

Step 1: Provision and manage CloudBase environments

Use Tencent Cloud APIs to create and manage CloudBase environments for your users. On first login, automatically create a dedicated environment and store the user-ID-to-environment-ID mapping.

→ See Environment & Resource Management API

Step 2: Connect MCP / Skill to Agent

Create an API Key for each user's environment, then configure CLOUDBASE_API_KEY + CLOUDBASE_ENV_ID in the Agent tool's MCP. Users can then operate CloudBase directly from the Agent with no login flow required.

→ See the "Configure MCP and Skill" section below

---

Solution Overview

The enterprise/platform manages the mapping between users and CloudBase environments, assigning each user a dedicated isolated environment, and securely delivering access credentials (API Key or temporary credentials) to the user's Agent tool:

• Users log in with self-owned accounts (employee ID, enterprise email, platform account, etc.) without needing Tencent Cloud accounts
• Users can be internal employees or C-end users/customers of the platform
• Each user has an independent CloudBase environment — databases, cloud functions, and storage are fully isolated; users cannot see each other's data
• The platform manages environment creation, API Key issuance, and lifecycle via API
• The user's Agent tool accesses the dedicated environment using the platform-issued credentials, with no Tencent Cloud login required

---

Quickly Build an AI Development Platform

If you need to build an AI development platform similar to Lovable, Bolt.new, or Vercel v0, you can quickly set it up based on our open-source project. For details, see Vibe Coding Platform Solution.

---

Overall Architecture

Isolation guarantee: Each API Key is bound to a specific environment ID by the CloudBase platform and enforced server-side. Even if an API Key is leaked, it can only access that user's own environment — lateral access to other users' data is not possible.

---

Credential Method Comparison

White-label mode supports three MCP credential methods. API Key is recommended:

Method	Use case	User awareness	Setup complexity
API Key (Recommended)	Platform issues credentials; no login action needed from user	None	Lowest
Custom Auth Code	User completes a one-time login via the platform's own domain	User clicks a branded link	Medium
Temporary Credentials	Platform server controls credential lifecycle, refreshed periodically	None	Medium

---

Configure MCP and Skill

White-label mode supports three connection methods. API Key is recommended — it's the simplest, requiring no login flow.

API Key (Recommended)

Simplest integration method. The platform creates an API Key for each user's environment and injects it into the MCP config. Users need no login or authorization flow at all.

Create an API Key

Call the Tencent Cloud CreateApiKey API to create an api_key type credential for the user's environment:

// Example: create an API Key for a user's environment
const result = await tcbClient.CreateApiKey({
  EnvId: userEnvId,       // the user's CloudBase environment ID
  KeyType: "api_key",     // server-side admin-level credential
  KeyName: `user-${userId}`,
  // ExpireIn: 7776000    // optional: validity period in seconds; omit for no expiry
});
// result.ApiKey is the plaintext token — returned only once, store it securely

Security Notice

api_key grants full admin access to the environment. Use it only server-side or in MCP configs — never expose it to clients or commit it to code repositories. Rotate periodically. Max 5 per environment.

You can also create one manually: CloudBase Console → Environment → API Key

MCP Configuration

Set CLOUDBASE_API_KEY and CLOUDBASE_ENV_ID in the Agent tool's MCP environment variables:

Client

Configure your AI tool to connect with CloudBase capabilities. Supports local and hosted connection. See connection modes.

Step 1: Install / Configure CloudBase

Use project template (recommended) - Template includes MCP configuration and AI rulesView templates

Install in one click:

Add to Cursor

Or manual configuration:

Or add this configuration to .cursor/mcp.json:

json

1{
2  "mcpServers": {
3    "cloudbase": {
4      "command": "npx",
5      "args": [
6        "@cloudbase/cloudbase-mcp@latest"
7      ],
8      "env": {
9        "INTEGRATION_IDE": "Cursor",
10        "CLOUDBASE_API_KEY": "<API Key for the user's environment>",
11        "CLOUDBASE_ENV_ID": "<the user's environment ID>"
12      }
13    }
14  }
15}

Need help?View Cursor docs

Step 2: Chat with AI

Enter the following in your AI chat in order:

prompt

Install CloudBase Skills: run npx skills add tencentcloudbase/cloudbase-skills -y

Use CloudBase Skills: Use CloudBase to operate the environment, configured via API Key

CLOUDBASE_API_KEY has the highest priority — no TENCENTCLOUD_* credentials or device-code login needed.

Custom Auth Code

Recommended approach. The enterprise's self-built authorization page proxies the device code flow. Users complete login entirely under the self-owned domain without perceiving Tencent Cloud.

Custom Authorization Page

The enterprise internal system needs to implement a custom authorization page to proxy the device code authorization flow:

1. Proxy device code request: When the AI tool initiates login, the enterprise system forwards the device code request to the CloudBase API
2. Rewrite auth link: Rewrite the authorization link returned by CloudBase to the self-owned domain (e.g., auth.your-domain.com/authorize?code=xxx)
3. Self-owned auth page: Users open the rewritten link and log in with their enterprise/platform account
4. Environment selection and authorization: After login, display the list of environments available to the user, and complete device code authorization after user selection
5. Obtain temporary credentials: After authorization is completed, the AI tool polls for temporary credentials via the device code

Automatic Environment Creation on First Login

When a user logs in for the first time, the enterprise system should automatically create a dedicated CloudBase environment:

1. Call CreateEnv to create the environment
2. Record the mapping between user ID and environment ID in the database
3. Locate the user's environment directly based on the mapping for subsequent logins

Permission Strategy

After user verification, the authorization service calls STS GetFederationToken to issue temporary credentials with policy restrictions. No sub-account is required.

Click to view the complete policy template JSON (white-label mode)

{
  "statement": [
    {
      "action": [
        "cam:CreateRole",
        "cam:AttachRolePolicy",
        "cam:GetRole",
        "cdn:TcbCheckResource",
        "scf:ListFunctions",
        "tcb:CheckTcbService",
        "tcb:DescribeEnvs",
        "tcb:DescribeBillingInfo",
        "tcb:DescribeEnvPostpayPackage",
        "tcb:DeleteTable",
        "tcb:CreateTable",
        "tcb:DescribeTable",
        "tcb:DescribeTables",
        "tcb:ListTables",
        "tcb:RunCommands",
        "tcb:UpdateTable",
        "tcb:UpdateItem",
        "tcb:QueryRecords",
        "tcb:PutItem",
        "tcb:ModifyNameSpace",
        "tcb:DeleteItem",
        "tcb:CountRecords"
      ],
      "effect": "allow",
      "resource": ["*"]
    },
    {
      "action": ["tcb:*"],
      "effect": "allow",
      "resource": ["qcs::tcb::uin/${uin}:env/${envId}"]
    },
    {
      "action": ["tcbr:*"],
      "effect": "allow",
      "resource": ["qcs::tcbr::uin/${uin}:env/${envId}"]
    },
    {
      "action": ["lowcode:*"],
      "effect": "allow",
      "resource": ["qcs::lowcode::uin/${uin}:env/${envId}"]
    },
    {
      "action": ["scf:*"],
      "effect": "allow",
      "resource": [
        "qcs::scf:${region}:uin/${uin}:namespace/${envId}",
        "qcs::scf:${region}:uin/${uin}:namespace/${envId}/function/*",
        "qcs::scf:${region}:uin/${uin}:namespace/${envId}/layer/*",
        "qcs::cls:${region}:uin/${uin}:logset/${logsetId}",
        "qcs::cls:${region}:uin/${uin}:topic/${topicId}"
      ]
    },
    {
      "action": ["cls:*"],
      "effect": "allow",
      "resource": [
        "qcs::cls:${region}:uin/${uin}:logset/${logsetId}",
        "qcs::cls:${region}:uin/${uin}:topic/${topicId}"
      ]
    },
    {
      "action": ["cos:*"],
      "effect": "allow",
      "resource": [
        "qcs::cos:${region}:uid/${appId}:${cosBucketId}/*",
        "qcs::cos:${region}:uid/${appId}:${staticBucketId}/*"
      ]
    }
  ],
  "version": "2.0"
}

Placeholder Description

Placeholder	Meaning	How to Obtain
${region}	Environment region	EnvList[0].Region returned by DescribeEnvs
${uin}	Main account UIN	Uin returned by GetUserAppId when called with the main account key
${appId}	Main account AppId	EnvList[0].AppId returned by DescribeEnvs, or extracted from the storage bucket name
${envId}	CloudBase environment ID	EnvList[0].EnvId returned by DescribeEnvs
${topicId}	CLS log topic ID	EnvList[0].LogServices[0].TopicId returned by DescribeEnvs
${logsetId}	CLS logset ID	EnvList[0].LogServices[0].LogsetId returned by DescribeEnvs
${cosBucketId}	Cloud storage bucket name	EnvList[0].Storages[0].Bucket returned by DescribeEnvs
${staticBucketId}	Static hosting storage bucket name	EnvList[0].StaticStorages[0].Bucket returned by DescribeEnvs

The resource format for tcb and tcbr does not contain ${region}, which is suitable for temporary credential scenarios in white-label mode.

Click to view the Node.js temporary credential issuance code example

// Install dependency: npm install tencentcloud-sdk-nodejs
// Usage:
// 1. Save the JSON from the "Policy Template" section as policy-template.json.
// 2. Set TENCENTCLOUD_SECRETID and TENCENTCLOUD_SECRETKEY.
// 3. Call issueTemporaryCredentials(envId, userId) from the authorization service.

const tencentcloud = require("tencentcloud-sdk-nodejs");
const fs = require("fs");
const path = require("path");

const AccountClient = tencentcloud.account.v20190119.Client;
const TcbClient = tencentcloud.tcb.v20180608.Client;
const StsClient = tencentcloud.sts.v20180813.Client;

const clientConfig = {
  credential: {
    secretId: process.env.TENCENTCLOUD_SECRETID,
    secretKey: process.env.TENCENTCLOUD_SECRETKEY,
  },
  region: "ap-shanghai",
};

const POLICY_TEMPLATE = fs.readFileSync(
  path.join(__dirname, "policy-template.json"),
  "utf8"
);

async function getPolicyVars(envId) {
  const accountClient = new AccountClient(clientConfig);
  const tcbClient = new TcbClient(clientConfig);

  // When the authorization service uses the main account key, Uin is the main account UIN.
  const [{ Uin }, { EnvList }] = await Promise.all([
    accountClient.GetUserAppId({}),
    tcbClient.DescribeEnvs({ EnvId: envId }),
  ]);
  const env = EnvList[0];
  if (!env) {
    throw new Error(`CloudBase environment ${envId} not found.`);
  }

  return {
    region: env.Region,
    uin: Uin,
    appId: String(env.AppId),
    envId: env.EnvId,
    logsetId: env.LogServices?.[0]?.LogsetId || "",
    topicId: env.LogServices?.[0]?.TopicId || "",
    cosBucketId: env.Storages?.[0]?.Bucket || "",
    staticBucketId: env.StaticStorages?.[0]?.Bucket || "",
  };
}

async function generatePolicy(envId) {
  const vars = await getPolicyVars(envId);
  const policyJson = POLICY_TEMPLATE.replace(
    /\$\{(\w+)\}/g,
    (_, name) => vars[name] || ""
  );
  return JSON.parse(policyJson);
}

async function issueTemporaryCredentials(envId, userId) {
  const stsClient = new StsClient({
    ...clientConfig,
    profile: { httpProfile: { endpoint: "sts.tencentcloudapi.com" } },
  });
  const policy = await generatePolicy(envId);

  const { Credentials } = await stsClient.GetFederationToken({
    Name: `user-${userId}`,
    Policy: JSON.stringify(policy),
    DurationSeconds: 1800, // 30 minutes, adjustable as needed
  });

  return Credentials; // { TmpSecretId, TmpSecretKey, Token }
}

module.exports = { issueTemporaryCredentials };

Related API References

API	Purpose	Documentation
GetUserAppId	Get main account UIN and AppId	Account-related APIs
DescribeEnvs	Query CloudBase environment details (storage bucket, log topic, etc.)	CloudBase API Overview
GetFederationToken	STS issues temporary credentials (policy passed inline, no need to create sub-accounts)	STS API GetFederationToken

For the complete reference implementation, see cloudbase-cli-auth-endpoint. For the integration guide, see Enterprise Self-built Device Code Authorization Service Integration.

MCP Configuration

TCB_AUTH_OAUTH_ENDPOINT

After setting a custom authorization endpoint, the MCP device code authorization flow will redirect to the address you specified (e.g., https://auth.your-domain.com) instead of the Tencent Cloud default authorization page. If not set, the Tencent Cloud default authorization page will be used.

Client

Configure your AI tool to connect with CloudBase capabilities. Supports local and hosted connection. See connection modes.

Step 1: Install / Configure CloudBase

Use project template (recommended) - Template includes MCP configuration and AI rulesView templates

Install in one click:

Add to Cursor

Or manual configuration:

Or add this configuration to .cursor/mcp.json:

json

1{
2  "mcpServers": {
3    "cloudbase": {
4      "command": "npx",
5      "args": [
6        "@cloudbase/cloudbase-mcp@latest"
7      ],
8      "env": {
9        "INTEGRATION_IDE": "Cursor",
10        "TCB_AUTH_OAUTH_ENDPOINT": "<custom authorization endpoint, e.g. https://auth.your-domain.com>"
11      }
12    }
13  }
14}

Need help?View Cursor docs

Step 2: Chat with AI

Enter the following in your AI chat in order:

prompt

Install CloudBase Skills: run npx skills add tencentcloudbase/cloudbase-skills -y

Use CloudBase Skills: Connect to my environment using CloudBase, authorization endpoint is https://auth.your-domain.com

Temporary Credentials

Obtain temporary credentials with policy restrictions via Tencent Cloud STS GetFederationToken API, suitable for scenarios where the server needs to control credential lifecycle.

Permission Strategy

The enterprise system calls GetFederationToken, passing the policy inline, to issue temporary credentials that can only access the specified environment:

// Save the temporary credential issuance example above as issue-temporary-credentials.js and reuse it here.
const { issueTemporaryCredentials } = require("./issue-temporary-credentials");

async function getMcpCredentials(envId, userId) {
  // envId comes from your user ID to CloudBase environment ID mapping.
  const credentials = await issueTemporaryCredentials(envId, userId);

  // Configure credentials.TmpSecretId / TmpSecretKey / Token in MCP.
  return credentials;
}

MCP Configuration

Client

Configure your AI tool to connect with CloudBase capabilities. Supports local and hosted connection. See connection modes.

Step 1: Install / Configure CloudBase

Use project template (recommended) - Template includes MCP configuration and AI rulesView templates

Install in one click:

Add to Cursor

Or manual configuration:

Or add this configuration to .cursor/mcp.json:

json

1{
2  "mcpServers": {
3    "cloudbase": {
4      "command": "npx",
5      "args": [
6        "@cloudbase/cloudbase-mcp@latest"
7      ],
8      "env": {
9        "INTEGRATION_IDE": "Cursor",
10        "CLOUDBASE_ENV_ID": "<user's environment ID>",
11        "TENCENTCLOUD_SECRETID": "<temporary SecretId>",
12        "TENCENTCLOUD_SECRETKEY": "<temporary SecretKey>",
13        "TENCENTCLOUD_SESSIONTOKEN": "<temporary SessionToken>"
14      }
15    }
16  }
17}

Need help?View Cursor docs

Step 2: Chat with AI

Enter the following in your AI chat in order:

prompt

Install CloudBase Skills: run npx skills add tencentcloudbase/cloudbase-skills -y

Use CloudBase Skills: Use CloudBase to operate the environment, temporary credentials configured via MCP

Credential Expiration

Temporary credentials have a validity period (default 30 minutes, configured via DurationSeconds). After expiration, re-issuance is required.

---

Large-scale / ToC Scenarios (Pay-as-you-go)

In addition to the "one environment per user (¥19.9/month)" plan, the White-label Mode also supports pay-as-you-go billing, which is more suitable for ToC products or scenarios with a large number of users:

• No per-user fee: No need to purchase the ¥19.9/month CloudBase Personal plan for each user
• Environment isolation still effective: Even with pay-as-you-go billing, each user's environment remains fully isolated
• Billed by actual usage: Only pay for actual database reads/writes, cloud function invocations, storage, traffic, etc.
• Extremely low cost: Low-activity users generate almost no cost, making it suitable for ToC products

The pay-as-you-go mode requires contacting the CloudBase product team to enable. Please contact us via the CloudBase Console or through business development channels.

---

Responsibilities of All Parties

Role	Responsibilities
Enterprise / Platform	User identity authentication, create CloudBase environments for users, maintain user↔environment mapping, issue API Keys or temporary credentials and deliver them to the user's Agent tool
Agent (user side)	Access the user's dedicated CloudBase environment using platform-issued credentials (API Key / temporary credentials), execute development tasks
Tencent Cloud CloudBase	Provide environment isolation, API Key permission enforcement, environment creation and resource management infrastructure

---

Verify Isolation Effect

After configuration is complete, verify that isolation is working:

1. Call DescribeEnvs with User A's API Key — confirm only User A's environment is visible
2. Attempt to access User B's environment resources with User A's credentials — should return a permission denied error
3. In the Agent's MCP, confirm that only resources within the user's own environment (database, cloud functions, storage) can be operated