To get an official Grok API key, sign up at console.x.ai and create a key on the console’s API Keys page. xAI’s quickstart also says to load the account with API credits before using the API; it does not specify a required amount. (xAI API; API quickstart)
Get an xAI API key
- Sign up or sign in at
console.x.ai. - Open API Keys and create a key.
- Store the key securely. For an application, use an environment variable or a secret-management tool rather than putting the key in source code. The quickstart uses
XAI_API_KEY. (API quickstart; API security FAQ)
The documentation cited here does not establish that a consumer Grok subscription is required for API access. Check the console for the requirements shown for your account rather than relying on third-party claims about subscription tiers.
An xAI API key is different from a key issued by an API gateway or other third party. A third-party key authenticates with that provider, not with xAI’s API. Use an xAI-issued key for the official xAI endpoint below.
Make a first Grok API request
The xAI REST reference documents the Responses operation at POST /v1/responses. Its request body requires input; the official quickstart demonstrates model set to grok-4.7 and a text prompt as input. The REST reference identifies https://api.x.ai as the inference API base URL and specifies Bearer-token authentication. (Responses API reference; REST API reference; API quickstart)
In a macOS or Linux terminal, set the key for the current shell session:
export XAI_API_KEY="your_xai_api_key"
Then send a test request:
curl -X POST https://api.x.ai/v1/responses \
-H "Authorization: Bearer $XAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "grok-4.7",
"input": "Reply with a short greeting."
}'
The Responses reference documents a response object with an output array and a status field. For a completed request, check that the returned object has status set to completed and includes output. (Responses API reference)
If authentication fails, first check that the environment variable is set in the same shell where you ran curl and that you copied the intended xAI key. The REST reference lists the inference API and Management API separately; a Management API key is not the credential to use for an inference request. (REST API reference)
Keep the key safe in production
- Keep the key on a server or in a trusted secret manager. Do not put it in browser or mobile-app code, a public repository, or source code. xAI’s security FAQ advises secure storage and warns against committing keys to source code. (API security FAQ)
- If you suspect a key has leaked, sign in to the xAI Console, open API Keys, and use the key’s menu to choose Disable key or Delete key. Then create a replacement and update the applications that need it. The security FAQ describes disabling a key temporarily or deleting it permanently. (API security FAQ)
For automated credential administration, xAI documents a separate Management API. It uses a Management API key, not the inference API key used for Grok requests. (Management API guide)
Sources
SpaceXSI API: Grok Models, API Keys & Pricing
Grok API Quickstart: Get Your API Key
Responses | Inference API - REST API Reference