OctaFuse 2.4.0: route DashScope speech through one gateway
Published
Production speech workloads are more than ordinary HTTP calls. ASR may use synchronous conversion or asynchronous jobs, TTS may return a complete audio file or stream chunks, and realtime speech must carry text, events, and binary frames in both directions over WebSocket.
Version 2.4.0 brings these paths into the OctaFuse routing model. Applications can keep using OpenAI-compatible audio endpoints or connect with the native DashScope realtime protocol. The gateway selects the Alibaba Cloud upstream, applies the configured adapter, and records real usage.
Provider imports now also cover Alibaba Cloud Model Studio, Model Studio Coding Plan, and Qwen AI Platform Token Plan without requiring every plan-specific endpoint to be entered manually.
The Admin control plane also receives an important security upgrade. A single shared MASTER_KEY is replaced by named Admin API Keys that can be scoped, rotated, and revoked. Different systems, automation jobs, and operations workflows can use isolated least-privilege credentials.
In one sentence:
Route ASR, streaming TTS, and realtime speech through one billing-aware gateway, then separate Admin permissions by caller identity and use case.
DashScope speech in the unified routing model
Section titled “DashScope speech in the unified routing model”Version 2.4.0 adds the DashScope protocol family with explicit audio operations and adapters. DashScope identifies an upstream protocol, not a vendor: one Alibaba Cloud Provider can expose both OpenAI-compatible and native DashScope endpoints.
The common client surfaces remain straightforward:
| Capability | Request surface | Behavior |
|---|---|---|
| ASR | POST /v1/audio/transcriptions | Keeps the OpenAI-compatible multipart contract |
| TTS | POST /v1/audio/speech | Supports complete audio responses and HTTP streaming |
| Realtime ASR / TTS | GET /v1/dashscope/realtime | Relays native DashScope events over WebSocket |
/v1/audio/speech. The Route Pool selects the Alibaba Cloud upstream, while the Target configuration determines the DashScope model and adapter.The route view follows the same layers used across OctaFuse. The Request Surface describes how the client calls the gateway, the gateway model maps the public capability, and the Upstream Target describes how the request reaches the Provider. Public model IDs and Provider model names remain independent, so applications do not need to know vendor-specific names or endpoint layouts.
Cross-protocol calls use an explicit adapter instead of guessing from model names. A route can convert OpenAI multipart ASR to Qwen-ASR or Fun-ASR, or map OpenAI speech requests to SpeechSynthesizer, Qwen-TTS, or MiniMax DashScope APIs. Explicit adapters make configuration errors visible and keep protocol conversion predictable.
Model Studio and Qwen Token Plan: unified routing for LLM, ASR, and TTS
Section titled “Model Studio and Qwen Token Plan: unified routing for LLM, ASR, and TTS”Alibaba’s standard API service and subscription plans use different credentials, quotas, and Base URLs. Version 2.4.0 keeps them as three separate Provider presets so plan traffic cannot accidentally use a pay-as-you-go endpoint:
| Provider preset | Directly configured by OctaFuse | Important boundary |
|---|---|---|
| Alibaba Cloud Model Studio | OpenAI-compatible chat plus native DashScope ASR, TTS, and realtime audio | Uses the standard Model Studio API key and pay-as-you-go endpoints |
| Alibaba Cloud Model Studio (Coding Plan) | OpenAI- and Anthropic-compatible text-model calls | Uses the plan key and coding.dashscope.aliyuncs.com; do not mix it with pay-as-you-go endpoints |
| Qwen AI Platform (Token Plan) | OpenAI- and Anthropic-compatible chat; qwen-audio-3.0-tts-plus TTS; qwen-audio-3.0-realtime-plus realtime speech | Uses an sk-sp- plan key with dedicated token-plan.cn-beijing.maas.aliyuncs.com endpoints |
Choose the matching preset, add the plan key, then import or create the required models and attach them to a Route Pool. OctaFuse preserves the dedicated plan endpoints so requests do not fall through to the standard Model Studio service and miss the plan’s Credits.
Alibaba’s current Token Plan catalog includes Qwen qwen3.8-max, qwen3.7-max, qwen3.7-plus, and qwen3.6-plus / flash; the team plan also lists text models from DeepSeek, Kimi, GLM, and MiniMax. Version 2.4.0 directly maps its audio routing to the catalog’s qwen-audio-3.0-tts-plus and qwen-audio-3.0-realtime-plus models.
File, streaming, and realtime audio
Section titled “File, streaming, and realtime audio”Each audio lifecycle has a separate path:
- Synchronous file ASR maps uploaded content to the upstream request and converts the result back to a compatible response.
- Asynchronous file ASR accepts a public
file_urlreachable by DashScope, then handles job submission and status queries. The gateway does not upload the source file on the client’s behalf. - HTTP / SSE TTS supports complete responses and continuous audio chunks without unbounded buffering.
- Realtime ASR / TTS uses
/v1/dashscope/realtimeto relay native task or session events and binary audio frames.
Realtime connections still use an OctaFuse user API key and a public gateway model:
wss://<gateway>/v1/dashscope/realtime?model=<gateway-model>&operation=<operation>Authorization: Bearer <gateway-api-key>The gateway replaces only the model in the startup event. Later text, binary frames, and server events keep the native protocol. Cloudflare Workers and the Node.js Proxy both support this path and share authentication, initial-connect failover, usage recording, and route configuration.
Bill ASR and TTS by seconds, tokens, or characters
Section titled “Bill ASR and TTS by seconds, tokens, or characters”Speech recognition and synthesis are both audio capabilities, but they do not share one billing unit. OctaFuse selects the model’s configured pricing mode:
| Capability | Billing mode | Usage source | Request log |
|---|---|---|---|
| ASR | Per second | Audio duration returned by the upstream; file metadata is used as an estimate when the response omits it, with the source recorded | billing_kind=audio_per_second, audio_duration_seconds |
| ASR | Per token | Input, output, audio, and text tokens from upstream usage | billing_kind=audio_tokens plus token counts |
| TTS | Per character | Upstream usage.characters | billing_kind=audio_per_character, audio_characters |
ASR can therefore represent either duration-priced models or transcription models priced by audio and text tokens. Usage, billing mode, and resulting cost are stored together. The new part in 2.4.0 is TTS character billing: audio_characters records the effective character usage returned by the upstream and applies the model’s per-character price.
Operators can inspect the final Provider and model, protocol, operation, adapter, upstream request ID, and whether a request was billed by seconds, tokens, or characters in the same request log. Audio binaries are not stored. If TTS does not return real character usage, the gateway does not substitute input length for the final charge or present a budget estimate as the final bill.
Named, scoped Admin keys instead of one MASTER_KEY
Section titled “Named, scoped Admin keys instead of one MASTER_KEY”External systems, automation jobs, and operations tools previously tended to share one MASTER_KEY for Admin API access. That made it difficult to identify the caller, limit each use case to the permissions it needed, or rotate one compromised credential without disrupting unrelated clients.
Version 2.4.0 separates browser sessions from Bearer identities and adds System Integration → Integration Keys:
MASTER_KEY into a full-permission legacy-master credential so existing clients keep working. After the deployment is stable, split credentials by caller identity and use case.Each integration key can:
- Identify a system, integration, automation job, or operations workflow with an independent name.
- Receive scoped permissions for users, user keys, Providers, models, routes, configuration, analytics, logs, or Playground execution.
- Split read-only, write, or specialized operations for the same system instead of expanding one credential’s permissions.
- Be rotated or revoked without affecting unrelated callers.
- Expose its last-used time for credential cleanup.
Only a Console Session can create, edit, or revoke Integration Keys. No Bearer Key—including one with *—can manage /admin/access-keys/*. This boundary prevents a caller from using its own credential to mint another Admin credential.
The old MASTER_KEY value continues to work through the migrated legacy-master key until it is revoked. Create named least-privilege keys based on caller identity and use case; update each caller’s GATEWAY_MASTER_KEY or equivalent setting; verify the integrations; then rotate or revoke legacy-master.
Admin configuration and operations
Section titled “Admin configuration and operations”Admin adds the supporting workflow for the new audio capabilities:
- Qwen Token Plan and Provider imports include DashScope audio endpoints.
- ASR / TTS catalog entries and route adapters are available for selection.
- Playground can exercise DashScope Realtime connections.
- Alibaba Cloud TTS pricing is corrected and CosyVoice 3.5 presets are included.
- Routes Flow improves Sticky binding summaries, refresh, user counts, and default topology density.
The result is a complete workflow from Provider configuration to audio model and route creation, Playground verification, and request-log inspection.
Summary
Section titled “Summary”OctaFuse is a self-hostable open-source AI capability gateway and operations console. It provides one interface for models, images, speech, and agent tools while keeping routing, keys, budgets, billing, logs, and audit data in your own infrastructure.
If you are consolidating multiple model Providers, speech capabilities, or scoped Admin access, visit the website to learn more or head to GitHub for the source and deployment documentation:
If OctaFuse is useful to your project, consider giving the repository a Star. Your interest and feedback help us keep improving routing, protocol adapters, and the self-hosted experience.