Base URL and First Request — Management API: Keys & Billing

The Management API: A Separate Control Plane

xAI’s Management API is distinct from the inference API you use to send prompts to Grok. It lets you administer your resources: create and manage API keys, configure billing, monitor usage, and control your team’s access. All this administration happens via a dedicated URL.

Base URL

This separation isn’t an implementation detail: it reflects a fundamental difference between the two APIs. One consumes tokens and runs models; the other administers, bills, and grants permissions. Keeping them on two domains and two sets of keys guarantees that a stolen application key can never create other keys or read your billing information.

https://management-api.x.ai

Do not confuse this with https://api.x.ai, which is the URL for inference calls (chat completions, embeddings, etc.). All management requests—keys, billing, analytics—go through management-api.x.ai.

Distinct URLs

REST

Standard Architecture

JSON

Exchange Format

Bearer

Authentication

Management API Authentication

The authentication mechanism is identical—a Bearer token in the Authorization header—but the key itself is not. This is the most common confusion when starting out, and it produces a perfectly opaque 401: nothing in the error message indicates that you simply presented the right key to the wrong API.

curl https://management-api.x.ai/auth/management-keys/validation \
  -H "Authorization: Bearer $MANAGEMENT_API_KEY"

This validation request (GET /auth/management-keys/validation) lets you verify that your management key is valid and active. It’s the simplest entry point to test your configuration.

Management Key vs Inference Key

Management key: grants access to management-api.x.ai endpoints (administration, billing, analytics)
Inference key: grants access to api.x.ai endpoints (chat, embeddings, images)

Both key types are generated from the xAI console, but their scopes differ. An inference key cannot access management endpoints, and vice versa.

Endpoint Structure

Management API endpoints follow a logical organization:

/auth/teams/{teamId}/api-keys — API key management
/auth/api-keys/{apiKeyId} — operations on a specific key
/auth/teams/{teamId}/models — accessible models
/auth/teams/{teamId}/endpoints — available ACL endpoints
/v1/billing/teams/{teamId}/ — billing and analytics

The teamId parameter is your team’s identifier in the xAI console, and it structures almost all endpoints. Each team has its own keys, quotas, and billing settings—making it the natural isolation unit: separating two projects into two teams also separates their budgets and access, without any additional configuration.

Your First Management Request

Here’s a complete example to validate your configuration:

# Define your management key
export MANAGEMENT_API_KEY="xai-mgmt-..."

# Validate the key
curl -s https://management-api.x.ai/auth/management-keys/validation \
  -H "Authorization: Bearer $MANAGEMENT_API_KEY" | python3 -m json.tool

If the response contains your team and key information, your configuration is working. If you get a 401 error, verify you’re using a management key (not an inference key).

Key Takeaways

The Management API uses https://management-api.x.ai, distinct from https://api.x.ai
Authentication uses a Bearer token in the Authorization header
Management keys and inference keys have separate scopes
The GET /auth/management-keys/validation endpoint lets you test your configuration
All management endpoints are organized around the teamId