OpenClaw
OpenClaw can use an OpenAI-compatible provider with a dedicated key and /v1 base URL. Keep the gateway and model settings in the OpenClaw configuration, set a dedicated budget and model allow-list, then restart its service and verify one private test message before exposing any channel.
Before you begin
Install only the current client release from its official publisher. Before changing local configuration, create a dedicated API key in the console; never reuse a personal, shared, or production deployment key.
Windows, macOS, and Linux
- Windows: use the current Windows installer or PowerShell workflow, then close all client processes after changing a config file.
- macOS: use the signed app or official terminal installer for your CPU; home-directory settings belong to that macOS user.
- Linux / WSL: follow the current distribution or official CLI instructions; WSL reads its Linux home directory, not the Windows profile directory.
Choose a model
Call GET /v1/models with the dedicated key and choose one returned data[].id. This key-scoped list is authoritative; a model in a previous configuration, article, or client picker is not an access guarantee.
Configure
{
"models": {
"providers": {
"aishop": {
"baseUrl": "https://ai.tavonilo.com/v1",
"apiKey": "sk-your-own-key"
}
}
},
"agents": {
"defaults": { "model": { "primary": "aishop/your-console-model" } }
}
}Verify
Check the key with /v1/models, make one small non-sensitive request, and retain only the timestamp, route, model, HTTP status, and request ID for support. A timeout does not prove a billable generation was not processed, so do not blindly replay long or image requests.
Recover safely
- 401: replace an incomplete, revoked, or wrong key; never paste it into a support request.
- 403: check the key group, model visibility, balance, and route permission.
- 404: use the base URL shown here, not a full endpoint, and do not append /v1 twice.
- 429: queue work and honor Retry-After when present; do not replay a batch concurrently.
- 5xx or timeout: make a bounded retry only when the operation is safe to retry. Keep time, route, model, HTTP status, and request ID in redacted logs.
Credential boundary
Use one key per device or workload. Never send an API key, auth.json, full private prompt, password, verification code, or payment data to support; revoke and replace a key immediately when exposure is suspected.