Manage API keys with the xAI Management API

Enterprise teams can create, list, update, and delete inference API keys programmatically. You need a management key from xAI Console → Settings → Management Keys. The management key is separate from inference API keys.

Base URL: https://management-api.x.ai (not api.x.ai). Specs live in the Management API Reference linked from the Management API guide.

Validate the management key

curl https://management-api.x.ai/auth/management-keys/validation \
  -H "Authorization: Bearer <Your Management API Key>"

Success returns meta about the management key. This call does not require ACL permissions on inference keys.

ACLs and rate limits

ACL	Meaning
api-key:model:*	All models available to the team
api-key:endpoint:*	All endpoints available to the team
api-key:endpoint:chat	Chat and vision
api-key:endpoint:image	Image generation
api-key:model:<name>	One model (names from the team models list)

Per-key limits on create/update:

Field	Meaning
qps	Queries per second
qpm	Queries per minute
tpm	Tokens per minute (null = no token cap)

When tpm trips, new requests are rejected; in-flight requests keep processing.

Create an API key

All models and endpoints, 5 qps / 100 qpm, no token cap:

curl https://management-api.x.ai/auth/teams/{teamId}/api-keys \
  -X POST \
  -H "Authorization: Bearer <Your Management API Key>" \
  -d '{
        "name": "My API key",
        "acls": ["api-key:model:*", "api-key:endpoint:*"],
        "qps": 5,
        "qpm": 100,
        "tpm": null
      }'

Response fields: "apiKey" (secret once) and "apiKeyId" (for update/delete/propagation).

List, update, delete

List (page with pageSize / paginationToken):

curl "https://management-api.x.ai/auth/teams/{teamId}/api-keys?pageSize=10&paginationToken=" \
  -H "Authorization: Bearer <Your Management API Key>"

Update qpm (field mask required):

curl https://management-api.x.ai/auth/api-keys/{apiKeyId} \
  -X PUT \
  -H "Authorization: Bearer <Your Management API Key>" \
  -d '{
        "apiKey": {
          "qpm": 200
        },
        "fieldMask": "qpm"
      }'

Delete:

curl https://management-api.x.ai/auth/api-keys/{apiKeyId} \
  -X DELETE \
  -H "Authorization: Bearer <Your Management API Key>"

Propagation, models, endpoint ACLs

After create, clusters may lag briefly. Check:

curl https://management-api.x.ai/auth/api-keys/{apiKeyId}/propagation \
  -H "Authorization: Bearer <Your Management API Key>"

List models for ACL strings (api-key:model:<name>):

curl https://management-api.x.ai/auth/teams/{teamId}/models \
  -H "Authorization: Bearer <Your Management API Key>"

List possible endpoint ACLs for the team:

curl https://management-api.x.ai/auth/teams/{teamId}/endpoints \
  -H "Authorization: Bearer <Your Management API Key>"

Audit events

curl "https://management-api.x.ai/audit/teams/{teamId}/events?pageSize=10" \
  -H "Authorization: Bearer <Your Management API Key>"

Useful query params: pageToken, eventFilter.userId, eventFilter.query, eventTimeFrom, eventTimeTo (ISO 8601). Events cover team settings, API keys, membership, and other admin actions.

Pitfalls

• Hitting https://api.x.ai with a management key — management traffic belongs on https://management-api.x.ai.
• Using an inference API key as the Bearer for management routes.
• Calling inference before /propagation reports ready after a fresh create.
• Omitting fieldMask on update — the mask names the fields you intend to change.