Deploy Grok Build for enterprise

Official enterprise docs cover network allowlists, managed config layers, authentication, permission locks, and Zero Data Retention (ZDR). Use this when rolling Grok Build out on managed workstations or CI.

Network allowlist

All traffic is HTTPS (port 443). Required hosts:

Host	Purpose
cli-chat-proxy.grok.com	Inference proxy, settings
auth.x.ai	OAuth2/OIDC

If you use enterprise OIDC, also allow your IdP domain. Optional hosts (api.x.ai, code.grok.com, assets.grok.com, x.ai, storage.googleapis.com) can be blocked with documented tradeoffs — for example, blocking code.grok.com keeps sessions local-only and disables share links. Prefer npm install -g @xai-official/grok when the shell installer hosts are blocked.

TLS is 1.2/1.3 via rustls with OS trust store roots. For TLS-inspecting proxies, install the proxy CA into the OS trust store. Honor HTTPS_PROXY / HTTP_PROXY / NO_PROXY, and set proxy idle timeouts to at least 10 minutes for long SSE responses.

Config layers (low to high priority)

Priority	Path	Role
1	/etc/grok/managed_config.toml	System-wide managed defaults
2	~/.grok/managed_config.toml	Per-user managed defaults
3	~/.grok/config.toml	User preferences
4	~/.grok/requirements.toml	User-level pins
5	/etc/grok/requirements.toml	System-level pins (MDM / golden images)

requirements.toml pins cannot be overridden by user config, env vars, or remote settings. Push /etc/grok/requirements.toml via MDM or bake it into golden images. Run grok inspect to confirm which policy loaded.

Authentication

Method	Trigger	Best for
Browser OIDC	grok login	Interactive terminals with a browser
Device code	grok login --device-auth	SSH, containers, headless hosts
External auth provider	auth_provider_command	Corporate IdPs / token brokers
API key	XAI_API_KEY or model.api_key	CI/CD (not refreshable)

Enterprise OIDC:

[auth.oidc]
issuer = "https://login.yourcompany.com"
client_id = "your-client-id"

Or GROK_OIDC_ISSUER / GROK_OIDC_CLIENT_ID. To force SSO and block first-party API-key skip, pin in requirements.toml:

[grok_com_config]
disable_api_key_auth = true
force_login_team_uuid = "<your-team-uuid>"

force_login_team_uuid also turns on disable_api_key_auth. An empty list rejects every login.

Headless CI permissions

grok -p "Review the API changes" \
  --permission-mode dontAsk \
  --allow 'Bash(git *)' \
  --allow 'Read' \
  --deny 'Bash(rm -rf *)' \
  --sandbox strict

dontAsk silently denies anything without an explicit allow. To lock always-approve off across the fleet, set in root-owned /etc/grok/requirements.toml:

[ui]
disable_bypass_permissions_mode = true

That lock is ignored from user-writable ~/.grok/requirements.toml. Claude Code managed-settings.json disableBypassPermissionsMode does not lock Grok always-approve — set the Grok key above. Day-to-day modes and sandbox profiles: Configure Grok Build permissions and Enable the Grok Build sandbox.

ZDR

Zero Data Retention is a team-level setting. When enabled, inference does not persist prompts, code, or responses at the proxy layer; local history still lives under ~/.grok/. Video tools under ZDR need user-supplied output storage — see the ZDR video storage docs.