# Security Disclosure Recommendation: Check for Unexpected Grok Usage

> Source: <https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-grok-usage>
> Published: 2026-10-22 00:45:50+00:00

# Security Disclosure Recommendation: Check for Unexpected Grok Usage

This guide is part of Railway's response [to the security disclosure published on October 21, 2026](https://blog.railway.com/p/security-disclosure-wednesday-october-21st).

*If you use Grok with Railway, disable any xAI API key that may have been exposed, review the Usage Explorer for requests you didn't make, and redeploy your services with a new key.*

If you have an xAI API key that may have been exposed, or your credit balance dropped without a matching change in your traffic, check your Grok usage. xAI's guidance is to disable or delete the key in the Console, create a replacement, and update your applications.

This guide applies the guidelines from xAI's [security FAQ](https://docs.x.ai/console/faq/security), extended to include Railway-specific operations.

## Disable the key

xAI keys belong to a team, so confirm you're viewing the right team before you look for the key. Your Railway services can't reach xAI until you deploy the replacement key in the next section.

1. Sign in to the [xAI Console](https://console.x.ai) and select the team that owns the key.
2. Click **API Keys** in the sidebar.
3. Click the vertical ellipsis next to the exposed key and select **Disable key** to stop it immediately, or**Delete key** to remove it permanently. Disabling is reversible and keeps the key's usage history attached to it, which helps the review below.
4. Click **Create API Key** to generate a replacement. Copy it now. The Console doesn't show it again.
5. Optional: after the review below, delete keys programmatically with the [Management API](https://docs.x.ai/developers/management-api-guide) , which needs a management key from**Settings** then**Management Keys** .

```
curl https://management-api.x.ai/auth/api-keys/{apiKeyId} \
  -X DELETE \
  -H "Authorization: Bearer $XAI_MANAGEMENT_KEY"
```

xAI participates in GitHub's secret scanning program. If a key is found in a public repository, xAI disables it and emails you. You still need to deploy a replacement key on Railway and review usage.

## Update the key on Railway

On Railway, your xAI key is a variable, so updating it means editing the variable and redeploying.

1. Open the service that uses the key and click **Variables** . If the key is a[shared variable](https://docs.railway.com/variables#shared-variables) , edit it once in**Project Settings** and every service that references it gets the new value when you deploy.
2. Set the variable to the new key, then deploy the [staged change](https://docs.railway.com/deployments/staged-changes) .
3. Confirm the new deployment is active and its logs show successful requests to xAI.

## Review for misuse

The Usage Explorer lets team admins filter by API key and by request IP, which helps separate an attacker's traffic from yours.

1. Open **Usage** in the Console sidebar. See[Usage Explorer](https://docs.x.ai/console/usage) .
2. Set **Group by** to**API Key** and the granularity to daily. Compare the exposed key's spend against its normal pattern during the exposure window.
3. Add a filter for the exposed key, then group by request IP, model, or cluster. If you see requests to models you don't use, that's likely the misuse. If your services use [static outbound IPs](https://docs.railway.com/networking/static-outbound-ips) , requests from any other IP are too. Without static IPs, your services egress from shared Railway IPs, so an unfamiliar address is a lead rather than proof.
4. Switch **Dimension** to**Tokens** or**Billing items** to quantify the unexpected usage.
5. Open **Billing** and check the credits consumed and any purchases you didn't make.
6. Review the team's members in **Settings** then**Team** for people you didn't invite.
7. If you need the charges reviewed, keep the usage details and contact xAI through the Console.

If you have any other questions, contact Railway support at [support@railway.com](mailto:support@railway.com).