xAI (Grok)

[official website]

You can connect to Grok models via your Grok subscription, or, via the API key. They are charged separately, and normal users are likely to use the Grok subscription way.

Grok subscription

Use a Grok account eligible for the OAuth flow below. A paid subscription does not by itself establish eligibility for every model or API. This integration is tested with offline fixtures, not a live subscription; compatibility does not guarantee provider authorization or account safety.

1. Configure the provider

If Grok subscription is already configured under Downstreams with these settings, skip to the next section 2. Connect.

Web UI

1. Open Downstreams, click + Add Provider, then select the new provider in the list.
2. Set its name to Grok subscription. Under API Formats, select only OpenAI.
3. Set API Host to https://api.x.ai/v1.
4. Under Authentication, select OAuth, then expand Advanced OAuth settings.
5. Set Flow to Auth Code + PKCE (loopback), then fill in:

Field	Value
Discovery URL	https://auth.x.ai/.well-known/openid-configuration
Client ID	b1a00492-073a-47ea-816f-4c329264a828
Scopes	openid profile email offline_access grok-cli:access api:access
Refresh skew (seconds)	120
Default token lifetime (seconds)	3600
Allowed endpoint hosts (one per line)	Enter x.ai on the first line and *.x.ai on the second.

6. Check Request nonce, Require refresh token, Refresh on unknown expiry, and Persist discovered endpoints.
7. Leave Authorization URL, Token URL, Client Secret, Extra Authorize Params, and Extra Headers empty. Discovery supplies the endpoints. Changes save automatically; no restart is needed. Continue to 2. Connect.

config.yaml

Add this entry to your existing downstreams list in config.yaml:

- id: xai
  name: Grok subscription
  api_formats: [openai]
  base_url: https://api.x.ai/v1
  auth:
    type: oauth
    flow: auth_code
    discovery_url: https://auth.x.ai/.well-known/openid-configuration
    client_id: b1a00492-073a-47ea-816f-4c329264a828
    scopes: "openid profile email offline_access grok-cli:access api:access"
    request_nonce: true
    require_refresh_token: true
    default_token_lifetime_secs: 3600
    refresh_on_unknown_expiry: true
    refresh_skew_secs: 120
    allowed_endpoint_hosts: [x.ai, "*.x.ai"]
    persist_discovered_endpoints: true
  output_model_ids: [grok-4]

Restart Tresor, then continue to 2. Connect.

2. Connect

1. Open Downstreams in the left sidebar, then click Grok subscription in the provider list.
2. Click Connect below that section. Tresor opens the provider's authorization page in a new tab; allow the popup if your browser blocks it.
3. Sign in to your eligible Grok account and approve access. Let the page redirect back to Tresor; it should show Connected.
4. Return to the dashboard and wait for Connected below the Connect button.
5. Under Models, click Fetch Models, then click Add beside the models you need. If discovery is unavailable, click ＋ Add Model and enter a model ID available to your account.

To disconnect, click Disconnect beside Connect, then confirm.

xAI API

Direct xAI API access uses an API key from the xAI Console. API billing and subscription access are separate.

Web UI

Web UI is more intuitive, but requires more manual operations.

In the "Downstreams" tab:

1. Click + Add Provider to create a separate API provider, then select it in the list.
2. Enter xAI API as its name.
3. Under API Formats, select OpenAI and OpenAI Responses.
4. Under Authentication, select API key and enter a key from xAI Console.
5. Under API Host, enter https://api.x.ai. Changes save automatically.
6. Under Models, click Fetch Models, then + Add beside each model you need. If discovery is unavailable, click + Add Model and enter a model ID.

config.yaml

Editing YAML is less intuitive, but requires fewer manual operations.

Replace YOUR-XAI-API-KEY with your API key and confirm the example model is available to your account.

~/.config/tresor/config.yaml

# Other settings omitted. Add this entry to your existing downstreams list.
downstreams:
  - id: xai-api
    name: xAI API
    base_url: https://api.x.ai
    api_formats:
      - openai
      - openai_responses
    output_model_ids:
      - grok-4
    is_enabled: true
    auth:
      type: api_key
      api_key: YOUR-XAI-API-KEY

Restart Tresor to apply the YAML changes.

For xAI's U.S.-only inference endpoint, use https://us.api.x.ai as the API host or base_url. Check regional availability and pricing before switching.

Done! Clients accessing Tresor can now use your configured Grok models.

Next step

• Configure your LLM Apps