Grok API

Authentication

All requests carry the API key in the Authorization header:

Authorization: Bearer sk-grok-...

Keys are prefixed sk-grok-. Rotate or revoke them in the dashboard. Never embed a key in client-side code, put a thin proxy in front instead.

Best practices

  • Store keys in environment variables, never in git.
  • Issue one key per environment (dev, staging, prod).
  • Use per-project keys so revocation is scoped.