API Keys Explained: How OpenClaw Connects to LLM Providers

#The Key to Your Agent's Brain

When you set up an OpenClaw agent, one of the first things you need is an API key. If you are new to the world of AI APIs, this step can feel confusing. What exactly is an API key? Why does OpenClaw need one? How does billing work? And how do you keep your costs under control?

This guide answers all of those questions in plain English.

#What Is an API Key?

An API key is a unique string of characters that acts as a password between your software and a service provider. When your OpenClaw agent needs to think — to process a message, make a decision, or generate a response — it sends a request to an LLM provider like Anthropic, OpenAI, or Google. The API key tells the provider who is making the request so they can authorize it and bill the correct account.

A typical API key looks something like this:

sk-ant-api03-Abc123XyZ...

#Why OpenClaw Needs an API Key

OpenClaw is an agent platform, not an AI model. It does not generate text or make decisions on its own. Instead, it orchestrates everything around the AI model — managing messaging channels, executing skills, maintaining memory, and handling the agent lifecycle.

The actual intelligence comes from an LLM provider's model (Claude, GPT, Gemini, etc.), which runs on the provider's cloud infrastructure. Every time your agent processes a message, the following happens:

1. Your agent receives a message through a connected channel (Telegram, Discord, etc.)
2. OpenClaw constructs a prompt that includes the message, conversation history, personality instructions, and available tools
3. OpenClaw sends this prompt to the LLM provider's API, authenticated with your API key
4. The provider processes the prompt and returns a response
5. OpenClaw parses the response, executes any requested tool calls, and sends the reply back through the messaging channel

Your API key is required for step 3. Without it, the provider rejects the request, and your agent has no way to think.

#How LLM Billing Works

LLM providers charge based on tokens — the fundamental units of text that models process. A token is roughly 3-4 characters of English text, or about 75% of a word. Both the text you send to the model (input tokens) and the text it generates back (output tokens) count toward your bill.

Here is a simplified example:

• You send a message to your agent: ~50 tokens
• OpenClaw adds conversation history and system prompt: ~2,000 tokens
• The model generates a response: ~300 tokens
• Total for this interaction: ~2,350 tokens

At Claude Sonnet 5's rates of $2 per million input tokens and $10 per million output tokens, those 2,050 input and 300 output tokens cost about $0.007. A hundred interactions a day at that size works out to roughly $21 a month.

#Understanding the Price Tiers

Each provider offers multiple models at different price points. The rates below are per million tokens and current as of September 19, 2026, taken from each provider's own pricing page.

Several of those rates move, with context length or with a date. GPT-6 Astra bills $10.00 and $50.00 on short context and $20.00 and $75.00 on long; OpenClaw's OpenAI models page puts the threshold plainly, "Requests above 272K input tokens have higher rates." GPT-5.6 Terra is $2.00 and $12.00 on short context and $4.00 and $18.00 on long, and the Luna row already carries both of its tiers. Gemini 3.1 Pro charges $2.00 and $12.00 only on prompts at or under 200K tokens and $4.00 and $18.00 above that, and it is still a preview model. Gemini 3.8 Flash is priced at $0.75 and $3.75 through December 31, 2026 and $1.50 and $7.50 after. The Best LLM Models for OpenClaw in 2026 carries the full comparison, with context windows and open-weight options alongside these prices.

Prices and config refs come from two different places, and the table above is only the first. Google publishes Gemini 3.8 Flash on its own model pages, while the constraint on the ref you write into openclaw.json is the one OpenClaw states: "Native endpoints need a supported model definition or provider-owned resolution." The newest Google Flash model OpenClaw's own docs name is gemini-3.7-flash, in the Code Mode page's list of models that bundled provider catalogs flag as preferred. That list is a subset rather than the whole catalog, so run openclaw models list --provider google on your own install before you pin one.

#Getting Your API Keys

#Anthropic (Claude)

Anthropic is the most popular provider for OpenClaw agents. Here is how to get your key:

1. Visit console.anthropic.com and create an account
2. Navigate to Settings > Billing and add a payment method
3. Go to Settings > Limits and set a monthly spending limit — start with $20 for personal use
4. Go to Settings > API Keys and click Create Key
5. Name it something descriptive like openclaw-agent
6. Copy the key immediately — it will not be shown again

OpenClaw reads an optional JSON5 config from ~/.openclaw/openclaw.json. The key itself belongs in the environment rather than in that file, which the next section covers; the config only names the model, as a provider/model ref:

// ~/.openclaw/openclaw.json
{
  agents: {
    defaults: {
      model: { primary: "anthropic/claude-sonnet-5" },
    },
  },
}

#OpenAI (GPT)

1. Visit platform.openai.com and create an account
2. Navigate to Settings > Billing and add a payment method
3. Set usage limits under Settings > Limits
4. Go to API Keys and click Create new secret key
5. Copy the key immediately

OpenClaw's OpenAI models page points a new setup at GPT-6 Astra: "Fresh API-key setup uses Astra."

// ~/.openclaw/openclaw.json
{
  agents: {
    defaults: {
      model: { primary: "openai/gpt-6-astra" },
    },
  },
}

#Google (Gemini)

1. Visit aistudio.google.com and sign in with your Google account
2. Click Get API Key in the navigation
3. Click Create API Key and select or create a Google Cloud project
4. Copy the generated key

// ~/.openclaw/openclaw.json
{
  agents: {
    defaults: {
      model: { primary: "google/gemini-3.1-pro-preview" },
    },
  },
}

#Keeping Your API Keys Safe

API key security is not optional. A leaked key means someone else can run up charges on your account or, worse, use your account for malicious purposes. Follow these rules:

Never commit keys to Git. Keep openclaw.json, ~/.openclaw/.env and anything else that holds a credential out of the repository. Better still, keep the key out of the config file altogether and let OpenClaw read it from the environment.

# Use environment variables instead of hardcoding keys
export ANTHROPIC_API_KEY="sk-ant-your-key-here"

When a provider entry does need a key, prefer a SecretRef over a literal. A plaintext string still works, because "Secret refs are additive: plaintext values still work", but a ref is the safer form: the config then names the variable instead of holding the secret. The documented shape is { source: "env" | "file" | "exec" | "store", provider: "default", id: "..." }:

// ~/.openclaw/openclaw.json
{
  models: {
    providers: {
      anthropic: {
        apiKey: { source: "env", provider: "default", id: "ANTHROPIC_API_KEY" },
      },
    },
  },
}

Across more than one machine, put the value in OpenClaw's shared secret store and point the same field at it with source: "store". A name that resolves to a secret kind, which includes anything ending in _API_KEY, refuses --value, so the CLI takes the value from piped stdin, from --value-file <path>, or from a no-echo prompt:

openclaw secrets store set ANTHROPIC_API_KEY

Set spending limits on every provider account. This is your safety net. If a key is compromised, spending limits cap the potential damage. Every major provider supports monthly spending limits in their dashboard.

Rotate keys periodically. Generate a new key every few months and delete the old one. This limits the window of exposure if a key was unknowingly compromised.

Use separate keys for separate purposes. If you run multiple OpenClaw agents or other applications, give each one its own API key. This makes it easy to track usage per application and revoke access individually if needed.

#Managing Multiple Providers

One of OpenClaw's strengths is its ability to work with multiple LLM providers simultaneously. You might use Claude Sonnet as your primary model, GPT-6 Astra as the failover behind it, and Gemini Flash for heartbeat runs. Each provider still needs its own key in the environment; the config file only names the refs. For the Gemini half, prefer an id OpenClaw's own docs name: its "Shipped preferred models" table lists gemini-3.7-flash under the google provider.

// ~/.openclaw/openclaw.json
{
  agents: {
    defaults: {
      model: {
        primary: "anthropic/claude-sonnet-5",
        fallbacks: ["openai/gpt-6-astra"],
      },
      heartbeat: {
        every: "30m",
        model: "google/gemini-3.7-flash",
      },
    },
  },
}

That configuration gives your agent resilience. OpenClaw takes agents.defaults.model.primary first, then walks agents.defaults.model.fallbacks in order, and auth-profile rotation happens inside a provider before OpenClaw moves to the next fallback model. The docs describe that list only as failover, never as per-task routing: nothing sends code generation to one model and quick replies to another. To keep routine work on a cheaper model, give the heartbeat its own model, which is one of the heartbeat block's supported fields.

#What's Next?

Now that you understand API keys, how billing works, and how to set up your provider accounts, you are ready to make informed decisions about your OpenClaw agent's configuration.

• Choosing the right model? Read The Best LLM Models for OpenClaw in 2026 for a detailed comparison of every major model.
• Ready to set up OpenClaw? Our Getting Started with OpenClaw guide walks you through the full installation process.
• Want to optimize costs? ClawDocx premium guides include a comprehensive Cost Optimization guide with advanced strategies for minimizing your monthly LLM spend while maintaining agent quality — including prompt engineering tips, model routing configurations, and real budgeting data from community members.

Understanding API keys is the foundation. Everything else — choosing models, optimizing costs, configuring failover — builds on top of this knowledge. You are now equipped to make smart decisions about how your agent connects to its AI brain.