Generate an API key

Programmatic access to Grok

The API key is the authentication token that lets your applications talk to the Grok models. Without it, no request goes through. This lesson walks you through creating and managing your keys in the xAI console.

Open the console

Go to console.x.ai and sign in with the account you created in the previous step. The console is your central dashboard for managing keys, monitoring usage, and setting up billing.

In the side menu, open API Keys (full path: console.x.ai/team/default/api-keys).

Create your first key

Click Create API Key. You can give each key a descriptive name to identify what it’s for:

• dev-local for your development environment
• prod-backend for your production server
• test-ci for your continuous integration pipeline

The key is shown only once, when you create it. Copy it immediately and store it somewhere secure (a password manager or a secrets vault). If you lose a key, you’ll have to generate a new one.

Key format

xAI API keys start with the xai- prefix followed by an alphanumeric string. That prefix helps you spot them quickly in your configuration files and detect them if they’re accidentally exposed in source code.

Management best practices

One key per environment

Create separate keys for each context. If a key leaks, you can revoke it without affecting your other environments.

Regular rotation

Renew your keys periodically, especially for production environments. The procedure is simple: create a new key, update your application, then delete the old one.

Check before sharing

Before you share a project, make sure no key is hard-coded in the source. Use .env files kept out of version control (add .env to your .gitignore).

Billing tied to keys

Every API call made with a key is counted and billed. xAI offers two modes:

• Prepaid credits: you buy credits in advance, and calls are deducted immediately
• Monthly billing: usage beyond your credits is billed at the end of the month

Check your billing information in the console before you start using the API, because invoices can’t be changed retroactively.

Test the key right away

Take thirty seconds to validate the key before you bury it in a project. The simplest test asks for the list of models:

curl https://api.x.ai/v1/models \
  -H "Authorization: Bearer xai-your-key"

A JSON response listing the models confirms that the key is active and billing is in order. A 401 error means the key was copied incorrectly; a 403 points to a permissions or credits problem. Diagnosing it here, at the source, saves you a debugging session later in the middle of your application code.

Key takeaways

• You create keys at console.x.ai/team/default/api-keys
• They start with xai- and are shown only once
• Create one key per environment and store them in a secrets vault
• Check your billing mode before any API call
• Validate each new key with a call to /v1/models before you integrate it