Setting Up API Keys | OpenClaw AI

Supported Providers

Provider	CLI Name	Environment Variable	Get Key At
OpenAI	`openai`	`OPENCLAW_OPENAI_KEY`	platform.openai.com
Anthropic Claude	`claude`	`OPENCLAW_CLAUDE_KEY`	console.anthropic.com
Google Gemini	`gemini`	`OPENCLAW_GEMINI_KEY`	aistudio.google.com
Grok / xAI	`grok`	`OPENCLAW_GROK_KEY`	console.x.ai
Ollama (local)	`ollama`	N/A (no key needed)	ollama.ai

Method 1: Environment Variables

Setting API keys as environment variables keeps them out of config files and is the recommended method for CI/CD and shared systems.

Linux / macOS (bash/zsh)

# OpenAI
export OPENCLAW_OPENAI_KEY="sk-proj-..."

# Anthropic Claude
export OPENCLAW_CLAUDE_KEY="sk-ant-..."

# Google Gemini
export OPENCLAW_GEMINI_KEY="AIza..."

# Add to ~/.bashrc or ~/.zshrc to persist across sessions
echo 'export OPENCLAW_OPENAI_KEY="sk-proj-..."' >> ~/.bashrc

Windows PowerShell

# Set for current session
$env:OPENCLAW_OPENAI_KEY = "sk-proj-..."

# Set permanently for current user
[System.Environment]::SetEnvironmentVariable("OPENCLAW_OPENAI_KEY", "sk-proj-...", "User")

Method 2: Using the CLI

Store keys in the OpenClaw config file using the config set command:

# Set OpenAI key
openclaw config set openai.api_key "sk-proj-..."

# Set provider to OpenAI
openclaw config set provider openai

# Set Claude key
openclaw config set claude.api_key "sk-ant-..."

# Set Gemini key
openclaw config set gemini.api_key "AIza..."

Keys stored this way are saved to ~/.openclaw/config.yaml with file permissions set to 600 (owner-only read/write).

Method 3: .env File

Create a .env file in your project directory. OpenClaw automatically loads it when run from that directory:

# .env
OPENCLAW_PROVIDER=openai
OPENCLAW_OPENAI_KEY=sk-proj-...
OPENCLAW_MODEL=gpt-4o
OPENCLAW_MAX_STEPS=30

# Run from the same directory — .env is loaded automatically
cd /my-project
openclaw run "Analyze this codebase"

Verifying Your Keys

# Check configured key (shows redacted value)
openclaw config get openai.api_key
# Output: sk-proj-***...

# Test the connection
openclaw run "Say hello" --provider openai
# If successful: Hello! How can I help you?

# Full diagnostic
openclaw config list

Security Best Practices

⚠️

Never commit API keys to source control

Add .env and ~/.openclaw/ to your .gitignore. Treat API keys like passwords — rotate them immediately if exposed.

Use .gitignore: Always add .env and any files containing keys to .gitignore
Use secrets managers: In production, use AWS Secrets Manager, HashiCorp Vault, or GitHub Secrets
Rotate regularly: Rotate API keys every 90 days or immediately after any exposure
Principle of least privilege: Create API keys with minimal required permissions
Separate keys per environment: Use different keys for dev, staging, and production

💡

See Also

Local LLM Models — use Ollama with no API key required
Environment Variables Reference
openclaw config command

Rotating and Revoking API Keys

Rotate keys regularly (every 90 days is a good practice) or immediately if a key leaks:

# 1. Generate new key on the provider dashboard
# 2. Update OpenClaw config
openclaw config set openai.api_key "sk-proj-NEW..."

# Or update the env var in your shell profile:
# nano ~/.bashrc  →  update OPENCLAW_OPENAI_KEY
# source ~/.bashrc

# 3. Verify new key works
openclaw run "Return the word OK" --model gpt-4o-mini

# 4. Revoke the old key on platform.openai.com/api-keys
echo "Old key revoked — rotation complete"

Detecting and Cleaning Leaked Keys

# Scan git history for accidentally committed keys
git log --all --full-history -- "**config*" "**.env*" \
  | grep -E "sk-[a-zA-Z0-9]{20}"

# If found — revoke immediately on the provider dashboard!
# Then remove from history with git-filter-repo:
pip install git-filter-repo
git filter-repo --replace-text <(echo "sk-proj-OLD==>REMOVED")

OS Keyring Integration

On desktop machines, store keys in the system keyring instead of plain-text config files:

# Install keyring support
pip install keyring

# Store key in keyring (one-time setup)
openclaw config set-secure openai.api_key "sk-proj-..."

# OpenClaw automatically reads from keyring on each run
# Key never written to disk in plain text

All Supported Providers Quick Reference

Provider	Config Key	Env Variable	Get Key At
OpenAI	`openai.api_key`	`OPENCLAW_OPENAI_KEY`	platform.openai.com
Anthropic	`anthropic.api_key`	`OPENCLAW_ANTHROPIC_KEY`	console.anthropic.com
Google Gemini	`gemini.api_key`	`OPENCLAW_GEMINI_KEY`	aistudio.google.com
xAI / Grok	`xai.api_key`	`OPENCLAW_XAI_KEY`	x.ai/api
Ollama	`ollama.base_url`	`OPENCLAW_OLLAMA_URL`	No key needed

← Configuration Local LLM Models →