This page is about creating an API key with Groq. For an All AI Ask key, see /api-keys.

How to Get a Groq API Key

How do I get a Groq API key?

Groq (Groq, Inc.) API key: open the official console, create a key for the correct project, workspace, or account, and copy it immediately. The key format is Groq API keys use the gsk_ prefix followed by provider-issued secret characters.. Use the least-privilege permissions for this service. Store it as GROQ_API_KEY in a server-side secret manager. Key creation itself does not require payment.

Verified 2026-08-14 source

Steps

  1. Open Groq Console API Keys and select the project that should own the credential. (verified 2026-08-14)
  2. Choose Create API Key, name it for one environment or service, and confirm. (verified 2026-08-14)
  3. Copy the key immediately and store it securely; Groq treats the complete value as a secret. (verified 2026-08-14)
  4. Use the free tier for initial testing or add a payment method to move to paid usage; charges and limits are managed at organization/project level. (verified 2026-08-14)
  5. Store the value as GROQ_API_KEY in a server-side environment or secret manager, never in source control or browser code. (verified 2026-08-14)

Key facts

Env varGROQ_API_KEY
Consolehttps://console.groq.com/keys
Key formatGroq API keys use the gsk_ prefix followed by provider-issued secret characters.
Scope and permissionsKeys are project-specific; organization roles determine who may create or manage them, while project permissions and model policies constrain use.
BillingFree-tier requests have the account limits shown by Groq; paid usage is metered and billed to the organization/project, not purchased per key.
Payment required before first callNo
Scoped to project/orgNo
Shown onceYes
Revoke a key →

Rotate or revoke a key

Rotation

  1. Create a new key in the selected project.
  2. Deploy it and verify a request.
  3. Revoke the old key after the cutover.

Revocation

  1. Open the project API Keys page.
  2. Select the key to retire or the key exposed in an incident.
  3. Revoke it and replace the secret in every deployment.

First API call

javascript example using gpt-oss-20b; the key stays in GROQ_API_KEY and is never included in the snippet.

const client = new OpenAI({
  apiKey: process.env.GROQ_API_KEY,
  baseURL: 'https://api.groq.com/openai/v1',
});

const response = await client.chat.completions.create({
  model: MODEL,
  messages: [{ role: 'user', content: 'Say hello in one sentence.' }],
});

console.log(response.choices[0].message.content);

FAQ

Do I need a credit card to get a Groq API key?

No — you can generate the key without a payment method, though usage limits stay low until you add one.

Can I see my Groq API key again after closing the page?

No — Groq shows the full key value exactly once. If you lose it, revoke it and create a new one.

Is this the same as an All AI Ask API key?

No. This page is about creating an API key with Groq directly, for calling their API yourself. For an All AI Ask key — one key that routes to Groq and every other provider we support — see /api-keys.

Groq provider hubGroq rate limits

Batch 49 · groq decision and evidence contributions. Surface verification: 2026-08-14. These are route-local, server-rendered fixtures; unavailable values are not inferred.

Groq organization-project-key topology map

Frozen Batch 49 fixture board. Formula / decision rule: eligible = organization + project + principal role + model policy + plan owner Boundary: OpenAI-compatible syntax cannot transfer an OpenAI credential or authorization.

Frozen fixture / field IDJoined inputs and observationCalculated resultState
batch49-groq-m1-r1
organization owner · production project
org=org-groq-1; project=proj-prod; role=owner; key=fp-grq-prod-01; policy=text+audio; plan=developer
Organization, project, principal, policy, and plan owner join the production endpoint set.
eligible=set {chat, transcription}PASS — project topology joined.
batch49-groq-m1-r2
sandbox project · project developer
org=org-groq-1; project=proj-sandbox; role=developer; key=fp-grq-sbx-02; policy=text-only; endpoint=chat
Sandbox key is valid but its policy excludes audio workloads.
eligible=chat; rejected=transcriptionPASS WITH POLICY BOUNDARY.
batch49-groq-m1-r3
model-policy restricted project · wrong-project key
org=org-groq-1; requested=proj-prod; key=fp-grq-sbx-02; project=proj-sandbox; model=compound; policy=not-allowed
The key belongs to the sandbox project and cannot inherit production model policy.
project/key mismatch → reject before callFAIL CLOSED — wrong project.

Provenance: Batch 49 groq module 1 first-party evidence and surface verification date 2026-08-14. Groq security onboarding. Missing joins fail closed.

Groq SDK-and-secret-placement validator

Frozen Batch 49 fixture board. Formula / decision rule: safe request = library/base URL + server secret source + correct bearer construction + clean scan Boundary: Shipped or logged secrets are hard failures even when the request succeeds.

Frozen fixture / field IDJoined inputs and observationCalculated resultState
batch49-groq-m2-r1
native SDK · CI secret
library=groq-sdk; base=api.groq.com; env=GROQ_API_KEY; boundary=server; header=Bearer; scan=clean; request=req-grq-1
Native SDK and masked CI injection construct the bearer header server-side.
decision=PASS; request identity joinedPASS — secure SDK path.
batch49-groq-m2-r2
OpenAI SDK with Groq base URL · curl bearer header
library=openai-compatible; base=api.groq.com/openai/v1; env=GROQ_API_KEY; header=Bearer; boundary=server; request=req-grq-2
Compatible syntax is acceptable only because host, key class, and server boundary join Groq.
decision=PASS WITH HOST CHECKPASS — provider host remains authoritative.
batch49-groq-m2-r3
browser bundle · copied .env
library=browser; base=api.groq.com; env=public artifact; boundary=client; logs=build output; scan=flagged; key=fp-grq-client-03
The secret crosses a client or log boundary.
decision=FAIL; revoke and move behind server proxyFAIL CLOSED — exposure.

Provenance: Batch 49 groq module 2 first-party evidence and surface verification date 2026-08-14. Groq security onboarding. Missing joins fail closed.

Groq key-inventory rotation ledger

Frozen Batch 49 fixture board. Formula / decision rule: rotation complete = every live consumer migrated AND every retired key rejected Boundary: Dormant or orphaned consumers keep a key in inventory until disproved.

Frozen fixture / field IDJoined inputs and observationCalculated resultState
batch49-groq-m3-r1
two-region API · queue worker · transcription worker
old=fp-grq-old-01; new=fp-grq-new-02; consumers=us/eu/queue/transcription=4/4; policy=validated; revoke=joined
All named consumers validate the new key and model policy.
coverage=4/4=100%; old rejection=observedCOMPLETE — retire old key.
batch49-groq-m3-r2
compound/tool workload · dormant key
key=fp-grq-dorm-03; project=proj-prod; last-use=Unavailable; consumers=none joined; policy=Unavailable; revoke=not-run
No evidence proves the key is unused or that its policy can be safely removed.
orphan state=Unresolved; inventory action=owner reviewUNRESOLVED — do not silently delete.
batch49-groq-m3-r3
compromised key
old=fp-grq-leak-04; new=fp-grq-new-05; consumers=6/6; last-use=09:30Z; revoke=09:35Z; negative=401
Replacement rollout, policy validation, and post-revoke rejection all join.
coverage=100% ∧ retired rejection=Yes → completeCOMPLETE — incident contained.

Provenance: Batch 49 groq module 3 first-party evidence and surface verification date 2026-08-14. Groq security onboarding. Missing joins fail closed.

Run the groq Batch 49 evidence scenario →