xAI

xAI is one provider with API-key and OAuth auth modes. OAuth works with models available to a SuperGrok or X Premium+ subscription. For shared concepts such as credential storage and model selection, see authentication and models.

At a glance

Method	Provider	Auth	Environment override
API key	xai	xai-api-key	XAI_API_KEY
OAuth	xai	xai-oauth	XAI_ACCESS_TOKEN

Both modes use https://api.x.ai/v1 and the static model allowlist maintained by Rho.

Sign in

Run /login, select xAI, then choose API Key or OAuth. /login xai opens the same method picker. You can also target either method directly:

/login xai-api-key
/login xai-oauth

API-key login opens a masked key entry box. /login xai-oauth asks whether to use a browser callback or device-code, even when a browser is available. The default option is browser on a graphical session and device-code when headless. Either choice always shows the authorize URL. rho login xai-oauth still auto-selects: it opens a browser when one can appear, and uses device-code in SSH and headless environments. --device-auth forces device-code on a graphical session:

rho login xai-oauth --device-auth

Credentials are stored in the configured credential store, not in config or transcripts.

Sign out

Delete the stored credential for one method at a time:

/logout xai-api-key
/logout xai-oauth

If the corresponding environment override is still present, that method stays available.

Environment overrides

XAI_API_KEY=...
XAI_ACCESS_TOKEN=...

XAI_API_KEY selects API-key authentication. XAI_ACCESS_TOKEN is the OAuth CI/development override. Environment variables override stored credentials for their respective methods. For normal interactive setup, prefer /login.

Models

xAI uses a static allowlist rather than a refreshable API list. grok-4.7, grok-4.6, grok-4.5, grok-build-0.1, grok-composer-2.5-fast, and grok-4.3 are available to both auth modes. Picking xAI without a model selects grok-4.7:

/model xai/grok-4.7

On xAI OAuth, /fast turns on faster serving for grok-4.7. Rho still shows grok-4.7 and sends grok-4.7-build-fast on the request. That id is grok-4.7 on faster serving, billed at twice the grok-4.7 token price. models.dev has no row for it, so Rho reads the grok-4.7 catalog entry and doubles its input, cached-input, and output rates, including the long-context tier. GET /v1/models omits the id. API-key login cannot use that serving path. /fast with no argument toggles. The choice is saved as model.fast_mode and shows as (fast) after the model name.

Codex uses the same /fast command, but Codex sends service_tier: "priority" instead of changing the model id.

For a non-interactive run, pass the provider, matching auth mode, and model. These flags also update the persistent default:

rho --provider xai --auth xai-api-key --model grok-4.7 run "hello"
rho --provider xai --auth xai-oauth --model grok-4.7 run "hello"

The retired xai-oauth provider value remains a compatibility alias. Config, CLI flags, favorites, and model references normalize it to provider = "xai" with auth = "xai-oauth".

Provide the matching environment override or log in once so Rho can read the stored credential.

Notes

• With OAuth, the statusline estimates an equivalent API cost from models.dev pricing (including long-context rate tiers when available) and labels it (sub).
• /limits reports the usage windows for xAI OAuth when you are logged in.
• Both auth modes attach xAI's hosted x_search tool on every Responses create turn. Hosted X Search is a provider amenity outside the agent tool allowlist: it remains available even when client tools are restricted or empty, and disappears as soon as the session switches away from xAI. It is independent of the client web_search tool. Activity streams as typed HostedToolActivity { name: "x_search", detail } run events.
• Both auth modes also attach xAI's hosted image_generation tool on create turns unless [xai] image_generation = false. The omitted key means on, and Rho does not write the [xai] table unless the value is off. In the TUI, /config → Tools exposes the same toggle when the conversation provider is xAI. The change applies to the next session. Generated-image previews are resized to fit a 1,024 × 768 pixel box without changing the original image. Preview decoding uses the same safety budgets as pasted images: at most 4,096 pixels per dimension and 80 MiB of decoder allocation. Images beyond those budgets can still be returned, but their previews are unavailable. Like x_search, it is a provider amenity outside the agent tool allowlist and disappears when the session leaves xAI. The model writes the image prompt and may generate or edit images in the same turn. Completed images arrive as image_generation_call items, stream as HostedToolActivity { name: "image_generation", detail } (the prompt), and are stored as assistant ContentBlock::Image. The TUI keeps that activity card for the prompt and paints a separate image card from the stored content on the completed turn and when the session is resumed. A slim replay item (without the image bytes) is kept so later xAI turns can restore the native image_generation_call for edits. Generated images can be large; they are persisted once in the session and resent on follow-up xAI turns.
• Both auth modes use xAI server-side context compaction (POST /v1/responses/compact) when automatic or manual compaction runs. The compact request body is only model plus full input (system messages included). The response is a single encrypted compaction item that replaces the prior window; host-owned system prompts are still retained client-side for portable handoff. The encrypted item only replays on a compatible xAI Responses turn for the same provider identity and model.