Access walkthrough: signing in to Z.ai surfaces

Anonymous access versus a registered account

The chat surface works without an account for quick evaluation, but nearly every developer workflow — API keys, history, model switching — requires registration.

The Z.ai chat surface is usable without logging in. Anonymous sessions allow a limited number of messages and access to a default model selection. Conversation history is not saved between sessions, model switching may be restricted, and there is no way to continue a previous conversation. For a quick first look at the chat quality, anonymous access is sufficient. For anything that involves actual work — evaluating the model on a specific task, comparing outputs across model sizes, or building any kind of integration — a registered account is the practical starting point.

API access and the BigModel console are both account-gated. There is no way to generate an API key without a registered and verified account. This is standard practice for any hosted LLM platform and is not a friction point specific to Z.ai — it exists because API keys carry billing authority and need to be tied to an accountable identity for rate-limit and payment purposes.

Account registration: step by step

Five steps take a new user from the registration page to a working API key on the BigModel console.

Registration starts at the BigModel console sign-up page. The flow asks for an email address, a phone number for SMS verification, and a password. The email step is straightforward — any working international email address is accepted. The phone step is where outside developers most often encounter friction, so it is worth knowing what to expect.

The accepted country list for phone verification has expanded substantially in recent years. Most North American, Western European, and major Asia-Pacific numbers work. Enter the number with the full international country code prefix (for US numbers, that is +1 followed by the ten-digit number). If the SMS does not arrive within two minutes, check that the country code is formatted correctly before using the resend option. The verification code expires quickly — five minutes is a common window — so have the phone available before requesting it.

After phone verification, set a strong password and accept the platform terms. The account is active immediately. The first post-registration step most developers take is navigating to the API keys section to generate a key for local testing.

Generating and managing API keys

API keys for the BigModel platform are created in the console's developer settings and shown in full only once at creation.

After login, the API keys section is accessible from the account or developer settings area of the console. Creating a key requires only a name. The naming convention matters more than it seems: keys named after the environment and project they serve (for example, "dev-local-chatglm", "prod-app-summariser") make key rotation much simpler six months later when you cannot remember which key belongs to which service. Give each key a name you will still understand when you are auditing usage in a future sprint.

The full key value is shown only once at creation. Copy it immediately to a secrets manager. If you lose the key before storing it, the only remedy is to delete the old key and create a new one — there is no way to retrieve the value after the creation screen is dismissed. The console does show the last few characters of each key, which is useful for identifying which key a specific service is using from an audit log.

Academic guidance from UC Berkeley security researchers on credential hygiene recommends treating API keys as passwords: never commit them to source control, rotate them on a schedule, and revoke them immediately if exposure is suspected.

Password recovery

Password recovery on the BigModel platform uses a standard email-link flow — the link expires after 30 minutes and the spam folder is the most common recovery obstacle.

The password-recovery link on the login page triggers an email to the address associated with the account. The reset link in that email is valid for 30 minutes. If the email does not arrive within five minutes, check the spam or junk folder — this is the most common reason the flow appears broken. Confirm that the email address you are entering on the recovery page matches exactly what was used during registration; accounts registered with a plus-aliased address (user+tag@example.com) require the full aliased address to recover.

After clicking the reset link and setting a new password, any active sessions are invalidated. API keys are not revoked by a password reset — they remain valid until manually deleted. If you suspect an account compromise, the right sequence is: reset the password first, then audit and rotate API keys as a separate step.

What a signed-in account unlocks

A registered account unlocks six capabilities that are unavailable in anonymous mode.

Feature availability: anonymous access vs. registered Z.ai account

Feature	Requires account	Notes
Chat surface (limited quota)	No — anonymous access available	Restricted message count per session; no history persistence
Full model catalog access	Yes	Some models are gated behind account verification
Conversation history	Yes	Saved per account; searchable across sessions
API key generation	Yes	Required for any programmatic or SDK-based access
Project-level usage analytics	Yes	Per-key token consumption histograms available in console