Support 24/7
Client areaGet started
Shared hostingManaged WordPressReseller hostingOpenClaw hostingVPS hostingDedicated serversManaged serversAbout usHow we compareRegionsKnowledge baseSupportDomainsSSLBlogClient area
OpenClaw hosting
Knowledge base / OpenClaw hosting

Add or rotate a model provider key

Where the key goes, how to switch the primary model, and why the spend limit belongs on the provider's side rather than yours.

Last updated: September 16, 2026

OpenClaw does not include a model. It talks to a provider’s API with your key, and that key is the one credential on the container that costs money if it leaks.

  1. 1Add the provider keyIn the control UI under Settings → Models.
  2. 2Choose the modelThe agent uses whichever model you set for the provider.
  3. 3Put the spend limit on the providerOn their side, where it can actually stop the spending.
  4. 4Rotate when something changesTwo steps, and it takes a minute.
The key, the model, the limit. The limit is the step people skip: the hosting plan is a fixed monthly price, the model API is not.

Where the key goes

Provider credentials are configured in the control UI under Settings → Models, or through openclaw onboard, which authenticates you with the provider interactively. Several keys can be held at once — useful when you are moving from one provider to another, or keeping a fallback.

The key does not belong in a message to the agent. Anything you type in a conversation goes into the agent’s memory, and the memory is backed up and searchable.

Choosing the model

openclaw models set anthropic/claude-opus-4-6

The same setting lives in the configuration as agents.defaults.model.primary. Change it, restart the agent, and send one message to confirm the new model answers before you leave.

Rotating a key

The rotation itself is two steps and takes a minute:

  1. Create the new key in the provider’s console.
  2. Add it in Settings → Models, confirm one message works, then delete the old key in the provider’s console — not before, so a failure is a rollback rather than an outage.

Rotate on a schedule, and immediately if a key was ever pasted somewhere it should not have been: a chat, a screenshot, a pull request, a support ticket.

Put the spend limit on the provider

This is the part people skip. Your hosting plan is a fixed monthly price; the model API is metered and can, in principle, run up a bill while you sleep. Every major provider offers usage limits and alerts on the key or the organisation — set them there, because that is the only place the limit is enforced no matter what the agent does.

Sensible defaults: a hard monthly cap you would be annoyed but not hurt to pay, and an email alert at half of it.

inSave plans cover the container — CPU, RAM, NVMe, updates, backups and hardening — at one price that does not change at renewal. What your agent spends with Anthropic, OpenAI or any other provider is billed by them, directly to you, and is not included.

If the agent stops answering

An expired or revoked key usually looks like an agent that receives messages and never replies. Check, in this order: the provider console for a disabled key or an exceeded limit, then the model setting, then the logs.

openclaw doctor --fix