grok.com
“Grok”
Tech check
What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.
The page doesn't make tech claims we check for (AI, on-chain, wallets, trading, own chain, staking, live data, an app).
What it is
- The site describes itself as: “Grok is an AI assistant built by SpaceXSI. Chat, create images, write code, and get real-time answers from the web and X.”E2
- It's built with Next.js and React (common tools for building web apps).E29E30
- Notable building blocks in its code: ProseMirror / Tiptap editor.E31
- In your browser it can ask for your location, can ask to use your camera or microphone, can ask to send you notifications, can copy text to your clipboard and 3 more.E38E39E40E41E42E43
- It has sections such as /imagine, /sign-in and /sign-up.E90
- While loading, it called 3 endpoints on its own servers, such as /monitoring, /api/auth/session and /api/auth/oauth/id-token/nonce.E47E48E49
Where your data goes
Analytics & trackingCount visits and record what you do on the page. 2
| static.cloudflareinsights.com | Cloudflare Web Analytics: page-view counter | 1×E9 |
| www.googletagmanager.com | Google Analytics / Tag Manager: Google's visitor analytics and tag loader | 1×E8 |
PaymentsHandle card or wallet payments. 3
| js.stripe.com | Stripe: card payments | 3×E12 |
| m.stripe.network | Stripe: card payments | 2×E14 |
| m.stripe.com | Stripe: card payments | 1×E15 |
Sign-in & accountsLog you in or manage accounts. 1
| accounts.google.com | Google Sign-In: log in with Google | 2×E13 |
How key features work
Payments
Payments are handled by Stripe and Stripe.js, so card or payment details go to them, not only to this site.E12E14E15E35
StripeStripe.jsSign-in and accounts
Sign-in and account features show up in its code or traffic (/api/auth/session, /api/auth/oauth/id-token/nonce and accounts.google.com).E48E49E13E36
/api/auth/session/api/auth/oauth/id-token/nonceaccounts.google.comLive updates
It keeps live connections open (WebSockets) so content updates without reloading.E44
websocketLoading its content
Its content loads from its own API while you browse (/monitoring, /api/auth/session and /api/auth/oauth/id-token/nonce).E47E48E49
/monitoring/api/auth/session/api/auth/oauth/id-token/nonceDrawing and editing in the browser
The page draws and edits graphics in your browser using ProseMirror / Tiptap editor and the canvas.E31E46
ProseMirror / Tiptap editorcanvasCookies and storage
Names only. We never store the values.
| Cookie | Set for | Kept | Whose |
|---|---|---|---|
| grok_device_idE16 | grok.com | about 400 days | the site |
| i18nextLngE17 | grok.com | about 365 days | the site |
| cf_clearanceE18 | grok.com | about 365 days | the site |
| __cf_bmE19 | grok.com | about 0 days | the site |
| __cuidE20 | grok.com | about 400 days | the site |
| __cuidE20 | grok.com | about 400 days | the site |
| __Host-id-token-nonceE21 | grok.com | about 0 days | the site |
| OptanonConsentE22 | grok.com | about 365 days | the site |
| g_stateE23 | grok.com | about 180 days | the site |
| mE24 | m.stripe.com | about 400 days | other company |
| __stripe_midE25 | grok.com | about 365 days | the site |
| __stripe_sidE26 | grok.com | about 0 days | the site |
localStorageE27: i18nextLng, chat-preferences, useImagineModeStore, __cuid, ot_anonymous_id, grok-main-thread-watch:7bbd362f-aa89-4604-9f14-f27bac7aaf26, modes-selected-id, xai-ff-bu
sessionStorageE28: grok-main-thread-watch-tab, sentryReplaySession, useMediaStore
Pages and API calls
Pages it links to
//imagine/sign-in/sign-upEndpoints
Called while loading (seen) or named in the code (code).
| grok.com/monitoring | seenE47 |
| grok.com/api/auth/session | seenE48 |
| grok.com/api/auth/oauth/id-token/nonce | seenE49 |
| /api/update-team-cookie | codeE50 |
| /api/clear-team-cookie | codeE51 |
| /rest/app-deployer/v1/projects/{project_id}/custom-domains | codeE52 |
| /rest/app-deployer/v1/moderation-reports | codeE53 |
| /rest/app-deployer/v1/deployments/{deployment_id}/status | codeE54 |
| /rest/app-deployer/v1/custom-domains/{domain_id} | codeE55 |
| /rest/app-deployer/v1/deployments/{deployment_id}/build-logs | codeE56 |
| /rest/app-deployer/v1/deployments:latest | codeE57 |
| /rest/app-deployer/v1/projects/{project_id}/remix-eligibility | codeE58 |
| /rest/app-deployer/v1/x-shares/{share_id} | codeE59 |
| /rest/app-deployer/v1/projects:init | codeE60 |
| /rest/app-deployer/v1/projects/{project_id}/x-share:initiate | codeE61 |
| /rest/app-deployer/v1/projects/{project_id}/shares | codeE62 |
| /rest/app-deployer/v1/projects/{project_id}/env-vars | codeE63 |
| /rest/app-deployer/v1/projects | codeE64 |
| /rest/app-deployer/v1/ping | codeE65 |
| /rest/app-deployer/v1/deployments/{deployment_id} | codeE66 |
| /rest/app-deployer/v1/custom-domains/{domain_id}:remove | codeE67 |
| /rest/app-deployer/v1/projects/{project_id}/env-vars:batchDelete | codeE68 |
| /rest/app-deployer/v1/projects/{project_id}/shares:remove | codeE69 |
| /rest/app-deployer/v1/projects/{project_id}/visibility | codeE70 |
| /rest/app-deployer/v1/projects/{project_id}/env-vars:batchSet | codeE71 |
| /rest/app-deployer/v1/projects/{project_id}/forking | codeE72 |
| /rest/app-deployer/v1/projects/{project_id}/xai-api-key | codeE73 |
| /rest/app-deployer/v1/projects/{project_id}/shares:add | codeE74 |
| /rest/app-deployer/v1/projects/{project_id}:unpublish | codeE75 |
| /rest/automations | codeE76 |
Evidence
Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.
Limits
- We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
- Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
- Some trackers only load after you accept cookies or log in, so the real list can be longer.
- We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
- This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id sccqRDgf.