Set up Grok: the app, X integration and the xAI API

1Choose your plan

On October 12, 2026, X launched The X Subscription: one plan for Grok, the Cursor coding app and X Premium benefits, with a weekly usage pool shared by Grok and Cursor. New customers start here, and existing X Premium, Premium+ and SuperGrok plans continue unless you switch (official pricing doc).

TechCrunch reports that Premium or higher is needed for the latest models. Team seats on Premium, Super and Ultra cost the same as the individual plans. Third-party models in Cursor, like Claude or GPT, aren't in the pool and bill at API prices.

2Know what Grok is good at

The X Help Center says Grok decides on its own whether to search public X posts and the web in real time.

X's help page itself warns that Grok can be confidently wrong.

Search X posts from the last 7 days about [company, product or topic]. Group what
people say into themes: praise, complaints, questions, comparisons with competitors.
For each theme, give 2-3 example posts with links and dates, and say roughly how
common it is. Flag accounts that look like bots or paid promotion. Don't present any
post as fact, and mark every claim that needs checking.

3Tour the app

Sign in at grok.com or the iOS or Android app with Google, X, Apple, GitHub or email. If you pay through X, connect it under Settings > Account > Connect your X Account so your benefits apply (FAQ). On X itself, tap the Grok icon in the navigation bar.

The model picker next to the send button offers Fast, Auto, Expert and Heavy (checked October 13, 2026). Use Fast for quick answers, Expert for harder problems, Auto to let Grok choose, and Heavy for the toughest jobs. Older tutorials show DeepSearch and Think buttons instead. Bigger jobs, like video or long tasks, draw more of your weekly pool.

Settings > Usage shows your weekly pool by product. When it runs out, paid features pause until the reset, unless you buy Extra Usage Credits (from $5 on the web, valid for a year) or turn on Auto Top Up with a monthly cap.

4Set privacy on X and on grok.com

These are two separate places, so set both.

On X (X's instructions):

1. Go to Settings > Privacy & Safety > Data sharing and personalization > Grok & Third-party Collaborators.
2. Under Data Sharing, untick the box that lets X use your public data and your Grok conversations to train and fine-tune models.
3. Under Grok Personalization, untick it too if you don't want your X activity used to tailor Grok.
4. To wipe past chats, go to Data sharing and personalization > Grok > Delete Conversation History. X says deleted chats leave its systems within 30 days.

Thumbs up or down feedback can still be used for training after you opt out. A private account (Audience and tagging > Protect your posts) also keeps your posts out of training and out of Grok's answers. And if you add @Grok to an encrypted X Chat group, X and SpaceXSI can read every message sent after that.

On grok.com and the apps: open Settings > Data Controls, turn off Improve the model, and use a Private Chat for sensitive one-offs. Build mode sessions can't be private and are kept so you can keep building (data FAQ). Delete uploads at grok.com/files.

5Set up the xAI API console

On The X Subscription, API calls come out of your plan's weekly usage pool: x.ai/pricing lists "Grok API" on Plus and up and says the pool covers Chat, Imagine, Voice, Bot and API access (checked October 13, 2026). Without a plan, or once the pool runs out, the console bills prepaid credits, which xAI's account FAQ treats as a separate balance. Keep a spend limit on either way.

1. Go to console.x.ai and sign in with the same account you use for Grok. You start in a Personal Team.
2. Open Billing and buy prepaid credits. Leave the invoiced billing limit at its $0 default: requests then stop when credits run out instead of running up an invoice (billing docs). If you turn on auto top-up, set the monthly maximum. The console warns you at 80%.
3. Open API Keys > Create API Key, one per app. Keys can be limited to specific models and endpoints and rate-limited, so grant only what the app needs.
4. Store the key in an environment variable or a password manager, never in code, a chat or a shared doc.

6Make your first call with the OpenAI SDK

The official openai package works with xAI once you change the base URL (quickstart). xAI treats the Responses API as its main endpoint and Chat Completions as legacy.

# Terminal: store the key once, never in code
export XAI_API_KEY="your-key"
pip install openai

# first_call.py
import os
from openai import OpenAI

client = OpenAI(api_key=os.getenv("XAI_API_KEY"), base_url="https://api.x.ai/v1")

r = client.responses.create(
    model="grok-4.7",
    input="In three bullets: what should a founder check before using AI for support?",
)
print(r.output_text)

# Add live X data with the x_search tool (billed per post fetched)
r = client.responses.create(
    model="grok-4.7",
    input="What are people on X saying about [your product] this week? Link each post.",
    tools=[{"type": "x_search", "from_date": "2026-10-06"}],
    extra_body={"max_turns": 2},  # caps rounds of searching
)
print(r.output_text)

Without the X Search or Web Search tool, Grok knows nothing newer than its training data. Prices as of October 2026, from the models page and pricing page:

xAI says it keeps API requests for 30 days for abuse checks and doesn't train on them without your permission.

7Use Grok safely at work

Grok has had public failures. In July 2025, Grok on X posted antisemitic content and xAI deleted the posts and apologized (Semafor). In January 2026, people used it on X to make sexualized images of real people, including children, and Ofcom opened a formal investigation into X (Ofcom). The European Commission opened its own proceedings (SCL). Build your rules around that.

• Real people: never generate or edit images of customers, staff, competitors or public figures.
• Publishing: a human reads every post, reply and image before it goes out under your brand. Keep the Grok watermark.
• Company data: use the API or a Grok Business workspace, which runs under business terms, rather than a personal plan.
• Customer-facing apps: add your own moderation, test with hostile prompts, and send a hashed safety_identifier per end user, so a violation is tied to that user and not your whole key.
• High-stakes calls: no Grok-only decisions on hiring, money, health or legal questions.

What's next

Get keys for every major model, with spending caps, in API keys, then set data rules and defenses across all of them in Safety and costs. To compare assistants, see Set up Gemini and Set up Claude.