Create an xAI inference credential for the correct team, check its endpoint and model permissions, and verify a minimal request. Keep billing ownership and secret rotation explicit before connecting an unattended worker.
Before you start
An inference API key belongs to a team and its creator. Check the selected console team before creating a credential; that team’s access and billing state are the relevant account context. Official documentation.
Decide which application will use the key and who owns its budget. A development script and a production service should have distinguishable credentials so their use can be attributed and restricted separately.
The console documents prepaid credits and invoiced billing as different payment arrangements. Confirm the intended payment path instead of assuming that a newly created credential includes an API allowance. Official documentation.
Step-by-step: create the key
- Sign in to xAI Console and select the team that should own the application.
- Open API Keys and choose Create API Key. Give the credential a name identifying its application and environment.
- Set endpoint and model permissions appropriate to the workload. Save the revealed secret in your server-side secret store.
- Record the key’s purpose and owner without copying its value into a ticket, screenshot or chat.
The full key is shown during creation. Keep inference credentials distinct from Management API credentials, which belong to a separate administrative interface. Official documentation.
After creation, verify the visible team and permission settings. An application that reads from a different secret configuration can keep using an old key even though the console shows the new one.
Set a spending limit / budget alerts
Inspect Billing for the team’s prepaid balance, any automatic credit purchases and invoiced spending settings. Auto top-up can replenish a balance; its controls should be reviewed separately from the monthly invoiced allowance. Official documentation.
Use the controls actually available to the team. Record what happens when funding is exhausted, who can purchase more credit and which application task should stop first. A low balance notification is useful only if a responsible person sees it in time.
Usage Explorer can group activity by key and model. Use that view to connect unexpected spending to the credential and workload that generated it. Official documentation.
Verify the key: first call with cURL and Python
The quickstart supports the Responses REST endpoint and the native Python client. Both examples below read XAI_API_KEY; the native client uses its own transport and response helpers. Official documentation.
curl --max-time 60 https://api.x.ai/v1/responses \
-H "Authorization: Bearer $XAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"grok-4.6","input":"Say hello.","max_output_tokens":128}'import os
from xai_sdk import Client
from xai_sdk.chat import user
client = Client(api_key=os.environ["XAI_API_KEY"], timeout=60)
chat = client.chat.create(model="grok-4.6")
chat.append(user("Describe a useful model API application in one sentence."))
response = chat.sample()
print(response.content)For REST, inspect the response’s actual output and usage fields. For the native client, inspect response.content. Generated text is variable, so a hard-coded example answer would not prove the integration works.
Retain the minimal request after it succeeds. If a larger application fails, rerun that baseline in the same process environment to separate account access from prompt assembly and optional features.
Where to put the key
Set XAI_API_KEY in the process environment or managed server secret configuration. Keep the credential out of browser bundles, saved notebook output and request headers captured by analytics. A public website should call its own authenticated server, which applies the application’s spending and access policy.
When using an OpenAI-compatible client, explicitly configure the xAI base URL and xAI key. The library’s package name does not determine which provider will receive a request. Official documentation.
Verify secret injection in the deployed environment. Setting a value in an interactive terminal does not automatically update an already running worker or another hosting environment.
Common rejections
A forbidden response can mean the key or team lacks permission. A missing model can mean an incorrect identifier, while an unauthorized response points toward the authorization setup. Inspect the actual diagnostic before replacing secrets. Official documentation.
Use xAI errors to separate transport, payload and access issues. Check the current model identifier and team capacity when the credential itself is valid.
Rotate and revoke
The console’s API Keys menu provides Disable key for a temporary stop and Delete key for permanent revocation. Create a replacement, update the application and verify it before removing an unexposed key that is still in legitimate use. Official documentation.
For an exposed credential, stop its access promptly and inspect relevant usage. A smooth deployment handoff does not justify leaving a known leaked value usable. Do not include the secret when documenting the incident.
Audit Log records security-relevant console activity. Review the events around a credential change when you need to establish who changed access. Official documentation.
Use the AI API cost calculator to turn the model and workload you are considering into an estimate.
Last verified · Source ↗
Frequently asked questions
Why does the selected team matter?
Can I use a Management API key for this tutorial?
Is Disable key the same as Delete key?
Where can I attribute usage to this application?
Why does my deployed process still fail after updating the key?
Sources
Last verified · Source ↗