Management API: Key and Billing Management — Grok for Large Enterprises

Manage your account without the console

The xAI Management API is a REST interface dedicated to managing your Enterprise account. Where the Inference API (api.x.ai) calls models, the Management API (management-api.x.ai) administers your resources. The distinction might seem minor. It isn’t. Anything that would otherwise require someone to open the web console and click becomes automatable here—traceable, reproducible, and integrable with the tools your teams already use.

Provision and rotate keys

Creating keys via the API lets you automate provisioning for a new application or environment:

curl -X POST "https://management-api.x.ai/auth/teams/{teamId}/api-keys" \
  -H "Authorization: Bearer $MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "cle-production-chatbot",
    "acls": ["api-key:endpoint:chat", "api-key:model:grok-4.3"],
    "qps": 10,
    "qpm": 100,
    "tpm": 1000000,
    "expireTime": "2026-12-31T23:59:59Z"
  }'

The parameters in this request fully define the scope of the key:

name: Human-readable identifier for the key
acls: List of permissions (authorized endpoints and models)
qps/qpm/tpm: Rate limits per second, per minute, and tokens per minute
expireTime: Automatic expiration date

Setting expireTime at creation is the habit that saves you the most trouble long-term: a key issued for a three-month pilot expires on its own instead of surviving indefinitely in a configuration file that no one reads anymore.

Regular key rotation follows the same security hygiene. The dedicated endpoint generates a new secret key and invalidates the old one:

curl -X POST "https://management-api.x.ai/auth/api-keys/{apiKeyId}/rotate" \
  -H "Authorization: Bearer $MANAGEMENT_KEY"

Warning: the old secret key is invalidated immediately and permanently. Prepare to deploy the new value in your secret manager before running the command, never afterward. Three read-only endpoints complete the set: GET /auth/teams/{teamId}/api-keys lists all keys for the team, GET /auth/api-keys/{apiKeyId}/propagation verifies that the key is propagated across all nodes, and GET /auth/teams/{teamId}/models lists accessible models with their pricing. The second is the one you consult right after a rotation, when an application still returns authentication errors and you’re unsure whether it’s an application bug or simply a propagation delay.

Track and control billing

Retrieving billing information uses a dedicated endpoint:

curl "https://management-api.x.ai/v1/billing/teams/{teamId}/billing-info" \
  -H "Authorization: Bearer $MANAGEMENT_KEY"

You retrieve invoice history with period filtering, here for March 2026:

curl "https://management-api.x.ai/v1/billing/teams/{teamId}/invoices?billingCycle.year=2026&billingCycle.month=3" \
  -H "Authorization: Bearer $MANAGEMENT_KEY"

Each invoice carries a status among PENDING, PAID, FAILED, and WILL_NEVER_BE_CHARGED. Surfacing a FAILED status in your monitoring is far better than learning about the incident via a service interruption on a Monday morning.

To prevent budget overruns, configure a monthly cap:

curl -X POST "https://management-api.x.ai/v1/billing/teams/{teamId}/postpaid/spending-limits" \
  -H "Authorization: Bearer $MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"monthlyLimit": 5000}'

If you operate on prepaid, check the balance the same way:

# Check balance
curl "https://management-api.x.ai/v1/billing/teams/{teamId}/prepaid/balance" \
  -H "Authorization: Bearer $MANAGEMENT_KEY"

Remember that prepaid credits are non-refundable, unless legally required. Size your purchases based on consumption observed over several weeks, not on optimistic growth projections.

Monitor your consumption at the right granularity

The analytics endpoint lets you track usage with fine granularity:

curl -X POST "https://management-api.x.ai/v1/billing/teams/{teamId}/usage" \
  -H "Authorization: Bearer $MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "analyticsRequest": {
      "timeRange": {
        "startTime": "2026-03-01 00:00:00",
        "endTime": "2026-04-01 00:00:00",
        "timezone": "UTC"
      },
      "timeUnit": "DAY",
      "values": [{"name": "tokens", "aggregation": "SUM"}],
      "groupBy": ["model"]
    }
  }'

This request returns daily token consumption, broken down by model, for March. By changing timeUnit, you switch from a monthly view to a per-minute view: possible values are MONTH, CALENDAR_WEEK, DAY, HOUR, QUARTER_HOUR, and MINUTE. Aggregations go well beyond simple totals, with SUM, AVG, MIN, MAX, P50, P90, P99, and COUNT. Percentiles characterize load effectively because averages smooth out the very spikes that determine the capacity you actually need.

The Management API then takes its place in your toolchain. You provision keys from Terraform or Pulumi just like a database, your CI/CD pipeline creates ephemeral keys for test environments then deletes them at the end of execution, monitoring scripts alert before the spending cap is reached, and your internal dashboards display consumption without a human exporting a CSV every Monday.

Key takeaways

The Management API on management-api.x.ai handles keys, billing, and metrics
Key rotation permanently invalidates the old secret key
Spending limits protect against budget overruns
Usage analytics offer granularity from minute to month
Integrate the Management API into your infrastructure tools to automate administration