How to Get a Groq API Key
How do I get a Groq API key?
Groq (Groq, Inc.) API key: open the official console, create a key for the correct project, workspace, or account, and copy it immediately. The key format is Groq API keys use the gsk_ prefix followed by provider-issued secret characters.. Use the least-privilege permissions for this service. Store it as GROQ_API_KEY in a server-side secret manager. Key creation itself does not require payment.
Steps
- Open Groq Console API Keys and select the project that should own the credential. (verified 2026-08-14)
- Choose Create API Key, name it for one environment or service, and confirm. (verified 2026-08-14)
- Copy the key immediately and store it securely; Groq treats the complete value as a secret. (verified 2026-08-14)
- Use the free tier for initial testing or add a payment method to move to paid usage; charges and limits are managed at organization/project level. (verified 2026-08-14)
- Store the value as GROQ_API_KEY in a server-side environment or secret manager, never in source control or browser code. (verified 2026-08-14)
Key facts
| Env var | GROQ_API_KEY |
| Console | https://console.groq.com/keys |
| Key format | Groq API keys use the gsk_ prefix followed by provider-issued secret characters. |
| Scope and permissions | Keys are project-specific; organization roles determine who may create or manage them, while project permissions and model policies constrain use. |
| Billing | Free-tier requests have the account limits shown by Groq; paid usage is metered and billed to the organization/project, not purchased per key. |
| Payment required before first call | No |
| Scoped to project/org | No |
| Shown once | Yes |
Rotate or revoke a key
Rotation
- Create a new key in the selected project.
- Deploy it and verify a request.
- Revoke the old key after the cutover.
Revocation
- Open the project API Keys page.
- Select the key to retire or the key exposed in an incident.
- Revoke it and replace the secret in every deployment.
First API call
javascript example using gpt-oss-20b; the key stays in GROQ_API_KEY and is never included in the snippet.
const client = new OpenAI({
apiKey: process.env.GROQ_API_KEY,
baseURL: 'https://api.groq.com/openai/v1',
});
const response = await client.chat.completions.create({
model: MODEL,
messages: [{ role: 'user', content: 'Say hello in one sentence.' }],
});
console.log(response.choices[0].message.content);FAQ
Do I need a credit card to get a Groq API key?
No — you can generate the key without a payment method, though usage limits stay low until you add one.
Can I see my Groq API key again after closing the page?
No — Groq shows the full key value exactly once. If you lose it, revoke it and create a new one.
Is this the same as an All AI Ask API key?
No. This page is about creating an API key with Groq directly, for calling their API yourself. For an All AI Ask key — one key that routes to Groq and every other provider we support — see /api-keys.
Batch 49 · groq decision and evidence contributions. Surface verification: 2026-08-14. These are route-local, server-rendered fixtures; unavailable values are not inferred.
Groq organization-project-key topology map
Frozen Batch 49 fixture board. Formula / decision rule: eligible = organization + project + principal role + model policy + plan owner Boundary: OpenAI-compatible syntax cannot transfer an OpenAI credential or authorization.
| Frozen fixture / field ID | Joined inputs and observation | Calculated result | State |
|---|---|---|---|
batch49-groq-m1-r1organization owner · production project | org=org-groq-1; project=proj-prod; role=owner; key=fp-grq-prod-01; policy=text+audio; plan=developer Organization, project, principal, policy, and plan owner join the production endpoint set. | eligible=set {chat, transcription} | PASS — project topology joined. |
batch49-groq-m1-r2sandbox project · project developer | org=org-groq-1; project=proj-sandbox; role=developer; key=fp-grq-sbx-02; policy=text-only; endpoint=chat Sandbox key is valid but its policy excludes audio workloads. | eligible=chat; rejected=transcription | PASS WITH POLICY BOUNDARY. |
batch49-groq-m1-r3model-policy restricted project · wrong-project key | org=org-groq-1; requested=proj-prod; key=fp-grq-sbx-02; project=proj-sandbox; model=compound; policy=not-allowed The key belongs to the sandbox project and cannot inherit production model policy. | project/key mismatch → reject before call | FAIL CLOSED — wrong project. |
Provenance: Batch 49 groq module 1 first-party evidence and surface verification date 2026-08-14. Groq security onboarding. Missing joins fail closed.
Groq SDK-and-secret-placement validator
Frozen Batch 49 fixture board. Formula / decision rule: safe request = library/base URL + server secret source + correct bearer construction + clean scan Boundary: Shipped or logged secrets are hard failures even when the request succeeds.
| Frozen fixture / field ID | Joined inputs and observation | Calculated result | State |
|---|---|---|---|
batch49-groq-m2-r1native SDK · CI secret | library=groq-sdk; base=api.groq.com; env=GROQ_API_KEY; boundary=server; header=Bearer; scan=clean; request=req-grq-1 Native SDK and masked CI injection construct the bearer header server-side. | decision=PASS; request identity joined | PASS — secure SDK path. |
batch49-groq-m2-r2OpenAI SDK with Groq base URL · curl bearer header | library=openai-compatible; base=api.groq.com/openai/v1; env=GROQ_API_KEY; header=Bearer; boundary=server; request=req-grq-2 Compatible syntax is acceptable only because host, key class, and server boundary join Groq. | decision=PASS WITH HOST CHECK | PASS — provider host remains authoritative. |
batch49-groq-m2-r3browser bundle · copied .env | library=browser; base=api.groq.com; env=public artifact; boundary=client; logs=build output; scan=flagged; key=fp-grq-client-03 The secret crosses a client or log boundary. | decision=FAIL; revoke and move behind server proxy | FAIL CLOSED — exposure. |
Provenance: Batch 49 groq module 2 first-party evidence and surface verification date 2026-08-14. Groq security onboarding. Missing joins fail closed.
Groq key-inventory rotation ledger
Frozen Batch 49 fixture board. Formula / decision rule: rotation complete = every live consumer migrated AND every retired key rejected Boundary: Dormant or orphaned consumers keep a key in inventory until disproved.
| Frozen fixture / field ID | Joined inputs and observation | Calculated result | State |
|---|---|---|---|
batch49-groq-m3-r1two-region API · queue worker · transcription worker | old=fp-grq-old-01; new=fp-grq-new-02; consumers=us/eu/queue/transcription=4/4; policy=validated; revoke=joined All named consumers validate the new key and model policy. | coverage=4/4=100%; old rejection=observed | COMPLETE — retire old key. |
batch49-groq-m3-r2compound/tool workload · dormant key | key=fp-grq-dorm-03; project=proj-prod; last-use=Unavailable; consumers=none joined; policy=Unavailable; revoke=not-run No evidence proves the key is unused or that its policy can be safely removed. | orphan state=Unresolved; inventory action=owner review | UNRESOLVED — do not silently delete. |
batch49-groq-m3-r3compromised key | old=fp-grq-leak-04; new=fp-grq-new-05; consumers=6/6; last-use=09:30Z; revoke=09:35Z; negative=401 Replacement rollout, policy validation, and post-revoke rejection all join. | coverage=100% ∧ retired rejection=Yes → complete | COMPLETE — incident contained. |
Provenance: Batch 49 groq module 3 first-party evidence and surface verification date 2026-08-14. Groq security onboarding. Missing joins fail closed.
