Grok API Tester

Read this before you paste a live API key

If none of this sits right for a particular credential, build the request here with the key field empty, press Copy as cURL, and add the key on your own machine. You get the exact request and the secret never leaves your laptop.

How to test a Grok API key

1. Create a key

Grok is the model family; the API that serves it is xAI's, at api.x.ai. The documentation now carries the SpaceXAI name, while the host, the console address and the SDK still say xAI, so expect to meet both. Keys are created in the console, where each key can be given a name and restricted to the endpoints and models it needs. The key is shown in full once, at creation.

2. Ask the API about the key

The request pre-filled above is a GET to https://api.x.ai/v1/api-key. Most providers make you infer a key's state from whether some other call succeeds. This endpoint simply describes the key that was used to call it, so it is the most direct check available.

3. Send the key as a bearer token

The Auth tab is already set to Bearer token; paste the key into the field. It is sent as Authorization: Bearer <key>, covered in the bearer token guide.

4. Send and read the response

A 200 with a JSON object means the key is valid. Read the fields, not just the status: they tell you what the key is allowed to do.

Valid key vs invalid key: what you'll see

A successful response describes the key: a redacted copy of it, the name you gave it, the team it belongs to, its access-control list, and flags that say whether the key or its team has been blocked or disabled.

GET https://api.x.ai/v1/api-key
Authorization: Bearer <your key>

200 OK → { "name": "…", "redacted_api_key": "…", "acls": [ … ],
           "api_key_blocked": false, "api_key_disabled": false, "team_blocked": false, … }

no header → 401  { "code": "unauthenticated:no-credentials",
                   "error": "No credentials presented." }

wrong key → 400  { "code": "invalid-argument",
                   "error": "Incorrect API key provided. …" }

The access-control list is the part worth reading. If a later request to a particular model fails with a permission error, this is where you find out whether the key was ever allowed to use it. A key whose acls do not cover the endpoint you are calling is working exactly as configured.

Why a bad xAI key gives you 400, not 401

The two failed responses above have different status codes, and the split is not the one most people assume. Sending no credentials is 401. Sending a key the API does not recognise is 400 with the code invalid-argument: the API treats an unknown key as a bad parameter, not as a failed login.

The consequence is practical. Error handling written for the usual convention — “401 means fix the credential, 400 means fix the request body” — will send a developer looking for a mistake in their JSON when the mistake is in their key. Google's Gemini API has the same habit, as the Gemini tester describes. When you write a client for this API, branch on the code string in the body, and log the error sentence beside it.

The error body is not OpenAI's

The xAI API accepts the same chat request format as OpenAI, and OpenAI's client libraries work against it. The error format is its own. In the two responses above, code and error sit at the top level and error is a string, so code that reads body.error.message, as an OpenAI integration would, gets undefined. The shape is not uniform across the API either: a request to a URL that does not exist is answered 404 with a nested error object holding a numeric code and a message. Write the client to accept error as either a string or an object. If you are pointing an existing OpenAI client at xAI, the error path is the part to test by hand, and the sample button under the console gives you a real failure to test it with.

403 and 429

403 Forbidden means the API knows who you are and the action is not allowed: the key's permissions exclude that endpoint or model, the key or team is blocked, or the team has no credits yet. Compare against the /v1/api-key response before assuming the key is broken. 429 Too Many Requests is a rate limit; back off exponentially, as the rate limiting guide describes.

Sending a prompt to Grok

There are two generation endpoints. xAI's documentation now leads with the Responses API and describes chat completions as a legacy endpoint that will not receive new features. Both answer today.

POST https://api.x.ai/v1/responses
Authorization: Bearer <your key>
Content-Type: application/json

{
  "model": "<MODEL-ID-FROM-YOUR-LIST>",
  "input": "Say hello."
}

The chat completions form is the one existing OpenAI-style code already sends:

POST https://api.x.ai/v1/chat/completions
Authorization: Bearer <your key>
Content-Type: application/json

{
  "model": "<MODEL-ID-FROM-YOUR-LIST>",
  "messages": [
    { "role": "user", "content": "Say hello." }
  ]
}

Take the model identifier from your own GET /v1/models response. We do not print one here: Grok model names are revised often, and your listing is the authoritative source for what your key can reach. To run either call, pick the endpoint from the list beside the console, add Content-Type: application/json in the Headers tab and paste the body into the Body tab. These requests are billed, unlike the key check. A body that is missing a required field is answered 400 or 422 before any tokens are spent, which is a cheap way to confirm the endpoint and the key agree with each other.

With an OpenAI SDK, set the base URL to https://api.x.ai/v1 and supply the xAI key. If a call fails in your code and works here, compare the base URL first, then the model name.

This console waits 30 seconds for a response and shows one completed body, so leave streaming off and keep test prompts short. A slow reasoning model can exceed that limit without anything being wrong with your key.

Grok is not Groq

The names are one letter apart and the products are unrelated. Grok is xAI's model family, served from api.x.ai. Groq is a separate company that runs open-weight models on its own hardware, served from api.groq.com. A key from one is meaningless to the other; if you have a Groq key, the Groq API tester is the page you want.

Provider APIs change — check the official docs

api-tester.com is an independent tool with no affiliation to, partnership with or endorsement from xAI. Nothing here is official documentation. Endpoints, model names, error wording and limits are the provider's to change, and this page can fall behind. For current and authoritative detail, consult the official xAI API documentation.

We have deliberately not quoted prices, rate limits or model identifiers. Those change fastest, and a stale figure stated confidently is worse than none. What this page describes is the durable shape of the API: how it authenticates, how its errors are structured, and how to read them.

Test other providers and related tools

Frequently asked questions