The Z.AI API Runs on Two Base URLs and One Bearer Token

The Z.AI API (application programming interface) lets you call Zhipu's GLM models from your own code. At Layer3Labs, we connect third-party model APIs to client systems and the tools behind our own sites.

Z.AI offers two base URLs. Use https://api.z.ai/api/paas/v4/ for clients that follow the OpenAI request format, or https://api.z.ai/api/anthropic for clients that use Anthropic's format. Both use the same API key and header, so switching between them only requires changing a configuration line, not creating another account.

What the Z.AI API Is and Where the Console Lives

The Z.AI API serves the GLM models over a network call, and every account task around it happens in the Z.AI console on z.ai. Registration, key creation, key revocation and billing are four different pages there, and a first-time developer needs the first two before a single request will return anything.

Developer access starts at the model API registration page. Keys are created and revoked on the API key list. Spend sits on its own billing page, which is the page to open when a request comes back rejected and you suspect the balance rather than the code.

The web chat at chat.z.ai is a separate product, described by Z.AI as an "Advanced AI Chatbot & Agent powered by GLM-5.3-Flash". Signing in there does not create an API key. You register for API access on its own page, and that trips up people who assume one login covers both.

• Register for API access at z.ai/model-api, before any key exists to copy
• Create, view and revoke keys on the API key list page, which is also where you rotate a leaked key
• Check balance and top up on the billing page, the first place to look when calls start getting rejected
• The chat product at chat.z.ai is separate, and a chat login gives you no API credential

How the Z.AI API Key Works

Z.AI authenticates every API request with a bearer token in a standard header: Authorization: Bearer YOUR_API_KEY. There is no separate signature step and no request signing, so any client that can set one header can call the Z.AI API.

One key works on both base URLs. That means a team can move from an OpenAI-format client to an Anthropic-format one without opening the console again. It also means a single leaked string exposes both surfaces. Read the key from an environment variable rather than hard-coding it, and a rotation becomes a configuration change instead of a code change and a redeploy.

Coding agents want the key in their own settings file rather than in your project. Claude Code, for example, reads its credential from ANTHROPIC_AUTH_TOKEN in ~/.claude/settings.json, alongside the base URL and the model names it should map to. The full walkthrough for that setup is on our Claude Code guide.

• Header format: Authorization: Bearer YOUR_API_KEY, the same on both endpoints
• One key covers the OpenAI-compatible and Anthropic-compatible surfaces, so plan revocation accordingly
• Keep the key in an environment variable so rotating it never needs a code deploy
• Claude Code takes the key as ANTHROPIC_AUTH_TOKEN in ~/.claude/settings.json, not in your repository

The Z.AI API Base URL and the Two Request Formats

Z.AI publishes a general base URL (uniform resource locator) of https://api.z.ai/api/paas/v4/, and an OpenAI-format client reaches chat by appending the path chat/completions to it. Point an existing OpenAI client at that base, swap the model name, and the call shape stays what your code already sends.

The Anthropic-compatible base URL is https://api.z.ai/api/anthropic. That value does not appear in the quick start. It is published on the Claude Code integration page instead, so a developer who reads only the quick start will conclude the Anthropic surface does not exist. Read both pages before deciding what the API supports.

In the integrations we run, the first-hour failure on an OpenAI-compatible endpoint is almost never the credential. It is the base URL. Most software development kits (SDKs) append their own path. Paste a full endpoint where the client expects a base, and you get a doubled path plus a 404 that reads like a permissions problem. People then spend the afternoon regenerating a key that was fine.

• OpenAI-compatible: base https://api.z.ai/api/paas/v4/, path chat/completions, so existing OpenAI client code keeps working
• Anthropic-compatible: base https://api.z.ai/api/anthropic, which is what Claude Code and similar agents expect
• The quick start documents only the first of the two, so the docs are not one unified reference
• Test the base URL on its own before wiring it into an application, so a 404 stays a five-minute problem

Callable Z.AI API Models and Their Exact Model Ids

The Z.AI quick start names four callable model ids: glm-5.3, glm-5.3-flash, glm-image and cogvideox-3. Ids are lowercase and hyphenated, so the GLM-5.3 you read in an announcement is not the string the API accepts. A mis-cased name is a common cause of a rejected first call.

GLM-5.3 is the current flagship, released on 2026-08-17, with 753 billion parameters and a 1-million-token maximum context on its Hugging Face model card. GLM-5.3-Flash is the 320-billion-parameter sibling, and it is the id to reach for on high-volume work where per-call cost matters more than the last few points of quality. Our GLM-5.3 guide covers what changed in that release.

Published rates run from $0.03 per million tokens for GLM-OCR up to $1.40 in and $4.40 out for GLM-5.3. Three models cost nothing at all, and they are GLM-4.7-Flash, GLM-4.5-Flash and GLM-4.6V-Flash, each listed at $0. The full rate card sits on our Z.AI pricing guide rather than here. One correction worth carrying: GLM-5.3-Flash is cheap, at $0.075 per million input tokens, and it is not one of the free models.

Billing method changes the model list. On the GLM Coding Plan, Z.AI serves GLM-5.3 and GLM-5.3-Flash only, routes a request naming GLM-5.2 or GLM-5.1 to GLM-5.3, and routes a GLM-4.7 request to GLM-5.3-Flash. If you need to pin an older GLM version for a re-run or a compliance record, the per-token API is the only way to get it. Our GLM Coding Plan guide has the quota detail.

• Callable ids named in the quick start: glm-5.3, glm-5.3-flash, glm-image, cogvideox-3
• Ids are lowercase and hyphenated, so copy them from the docs rather than from a headline
• Free at $0: GLM-4.7-Flash, GLM-4.5-Flash and GLM-4.6V-Flash, which makes them the sensible choice for a throwaway test script
• GLM-5.3-Flash costs $0.075 per million input tokens, so it is cheap rather than free
• The GLM Coding Plan serves only GLM-5.3 and GLM-5.3-Flash, and silently routes older model names to those two

Choosing Between the OpenAI-Compatible and Anthropic-Compatible Endpoints

The endpoint you should pick follows the client library you already own, not the model you plan to call. Both surfaces reach the same GLM models with the same key, so the decision is about how much of your existing code survives.

This split does not help everyone. If your stack has neither an OpenAI nor an Anthropic client, a compatibility layer buys you nothing. Call the general base URL directly and parse the response yourself. Teams that need an audited, version-pinned model for regulated work should also read our note on Chinese AI model security risks before they wire anything into production.

One change would flip this recommendation. If Z.AI documented the Anthropic-compatible base URL in the quick start beside the general one, the two surfaces would be equal choices. The client you happen to own would stop being the tie-breaker.

• Already calling OpenAI-format endpoints: change the base URL and the model name, and keep the rest of the code
• Running Claude Code, Cline or OpenCode: use the Anthropic base URL, which is what those clients expect
• Neither of the above: call https://api.z.ai/api/paas/v4/chat/completions directly and read the response yourself

Z.AI API Rate Limits and Status

Z.AI does not publish a per-tier breakdown of requests per minute (RPM) or tokens per minute (TPM) for its API. Any specific throughput figure you find quoted elsewhere is unverified. Read your own account limits on the API key list in the console, then size a pilot against the throughput you observe there.

The GLM Coding Plan is the one place Z.AI does publish quotas, and they are counted in credits rather than request rates. Lite gets 2,000 credits per 5 hours and 10,000 per week, Pro gets 12,000 and 60,000, and Max gets 28,000 and 140,000, with a 50% deduction on off-peak usage. Both windows apply at once, and none of it governs per-token API billing.

As of 2026-09-02, the quick start and the GLM Coding Plan docs do not link a public status page. When calls start failing, that leaves you checking your key, your balance and your quota in the console. Write retry-with-backoff into the client from the first commit rather than after the first incident. A queue that retries twice with a widening delay costs an hour to add. Before you build on the Z.AI API, send one call with a free model id. That single request confirms the key, the base URL and the model name at once.

• Per-tier RPM and TPM caps: not published, so treat any quoted number as unverified
• Console limits are the only account-specific figures you can trust, and they are on the API key list page
• GLM Coding Plan quotas run on a 5-hour and a weekly window at once, with 50% off-peak deduction
• No public status page is linked from the docs as of 2026-09-02, so backoff and retry are your visibility