Match the flow to the terminal
Use the sign-in command for an interactive workstation. For a remote or browser-restricted environment, request device-code authentication explicitly and complete the displayed verification flow.
Do not copy cached tokens between machines. Each environment should establish its own authenticated session so access can be revoked independently.
grok login
# Remote, SSH, or browser-restricted terminal
grok login --device-authUse an API key only where it belongs
Headless environments can authenticate with XAI_API_KEY. Inject it through the CI secret store or process environment; never place the value in AGENTS.md, project config, shell history, source code, or a captured transcript.
Scope keys by environment and owner. The command below deliberately assumes a secret manager or parent shell already injected the variable, so the value never appears in the copied command. Rotate a leaked value immediately and review affected logs and artifacts.
- Prefer short-lived or narrowly scoped access where available.
- Mask XAI_API_KEY in CI logs.
- Never expose the key to browser-side JavaScript.
# XAI_API_KEY is injected by the parent shell or secret manager.
test -n "$XAI_API_KEY" && grokVerify, separate, and revoke
Start a small session and confirm the intended account or team is active before allowing repository tools. Authentication success does not grant authority to every file, network target, or production action.
Sign out when handing over a machine or removing local access. Then remove any process-level API key from the environment and invalidate compromised keys in the xAI console.
grok logout