Bearer token authentication — Grok API quickstart

Secure your API calls

Getting Started guide in the xAI documentation Every request sent to the xAI API must be authenticated. The API uses the Bearer token scheme, a widely adopted standard for REST APIs. This lesson explains how the mechanism works and the best practices for protecting your keys in production.

The Bearer token scheme

As the name suggests, whoever holds (“bears”) the token can access the API. That’s why protecting your key is fundamental: there’s no identity check beyond the token itself.

Header format

Every HTTP request must include the Authorization header with the Bearer prefix followed by your key:

Authorization: Bearer xai-your-api-key

With cURL, that gives:

curl https://api.x.ai/v1/responses \
  -H "Authorization: Bearer $XAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "grok-4.5", "input": "Hello"}'

In Python, the SDKs handle this header automatically when you pass the key to the client constructor.

Authentication errors

HTTP 401 Unauthorized

This error means your key is missing, invalid, or revoked. Check:

That the XAI_API_KEY environment variable is set
That the key starts with xai-
That the key hasn’t been revoked in the console

HTTP 403 Forbidden

Your key is valid but doesn’t have the permissions required for the requested action. This can happen with team restrictions on certain operations.

Security best practices

Never expose a key in code

Keys must never appear in plain text in:

Versioned source code (Git)
Application logs
URLs or query parameters
Error messages shown to users
GitHub issues and pull requests

Use a secrets vault

In production, store your keys in a dedicated system:

AWS Secrets Manager or Parameter Store
Google Secret Manager
Azure Key Vault
HashiCorp Vault
Your CI/CD platform’s secrets (GitHub Actions, GitLab CI)

Key rotation

Change your keys regularly, and immediately if you suspect a leak:

Create a new key in the xAI console
Update the key in your secrets vault
Redeploy your application
Check that everything works with the new key
Revoke the old key in the console

Limit permissions

If you work in a team, create separate keys for each service and environment. If one is compromised, the impact stays limited to a single context.

Leak detection

The xai- prefix lets detection tools (GitHub secret scanning, GitGuardian, TruffleHog) identify keys in source code automatically. Turn these tools on in your repositories so you’re alerted immediately in case of accidental exposure.

If a key is detected in a public commit:

Revoke it immediately in the xAI console
Check your usage history for fraudulent use
Create a new key
Clean up your Git history (or better, treat the key as compromised and move on)

HTTPS required

The xAI API only accepts HTTPS connections. TLS encrypts your requests in transit, including the Authorization header. Never try to get around this protection: a request over unencrypted HTTP would expose your key on the network.

Key takeaways

The API uses the Bearer token scheme through the Authorization header
The key is the only authentication factor: protect it like a password
Use a secrets vault in production, and never hard-code a key
Turn on leak detection in your Git repositories
Rotate keys regularly and revoke any compromised key immediately

Check your understanding

The xAI API foundations: one last check before you build.

1. What should you do with an API key as soon as you create it?

Answer: Store it somewhere safe (it’s shown only once), expose it through the XAI_API_KEY variable rather than hard-coding it, use one key per environment, and test it right away with a call to /v1/models.

2. What's the base URL, and why does it matter so much?

Answer: https://api.x.ai/v1. It’s what makes OpenAI compatibility possible: changing base_url and the key is enough to point existing OpenAI code at Grok.

3. Which SDKs can you use with Grok?

Answer: The native xAI SDK, the OpenAI SDK (with the xAI base_url), and the Vercel AI SDK on the JavaScript side, plus cURL for testing: the ecosystem is open.

4. What's the main generation endpoint?

Answer: POST /v1/responses, the modern format; chat/completions remains available as a legacy option for compatibility.

5. How is each request authenticated?

Answer: With the Authorization: Bearer header and the xai-… key: the standard Bearer token scheme, the same whatever the SDK or tool.

A secured key, the base URL, your choice of SDK, Bearer everywhere: the foundation is in place, and the next API courses build on it.