Confidential AI API: Secure LLM Inference at Scale

OpenClaw can use Prem API as a custom OpenAI-compatible provider. OpenClaw sends Chat Completions requests to the local Confidential Proxy, which encrypts them before network egress.

OpenClaw, its workspace, channels, local tools, plugins, and MCP servers remain outside the Prem confidential runtime. This setup protects supported model traffic, not the complete agent.

Confidential API
Router (Beta)

Use the local Confidential Proxy for sensitive model traffic. Go to the confidential setup.

Confidential API

How the connection works

Before you start

You need:

OpenClaw installed. See the OpenClaw setup guide.
A Prem API key. See API Keys.
A 32-byte client KEK encoded as 64 hexadecimal characters.
The current Prem gateway and enclave endpoints.
A chat model returned by your Prem model-list request.

Check the installed version:

openclaw --version

This configuration has been exercised with OpenClaw 2026.7.1-2 using a normal agent turn and a local file-reading tool call.

1. Set your secrets

export PREM_API_KEY="your-prem-api-key"
export CLIENT_KEK="your-64-character-hex-kek"
export PROXY_URL="https://gateway.prem.io"
export ENCLAVE_URL="https://conf-engine.prem.io"

Generate the KEK once if you do not have one:

openssl rand -hex 32

Store the KEK in a secret manager. Do not place either secret in openclaw.json as a literal value.

2. Start the Confidential Proxy

npx -p @premai/api-sdk@1.0.59 confidential-proxy \
  --host 127.0.0.1 \
  --port 8787 \
  --compat openai \
  --kek "$CLIENT_KEK"

Do not use --no-attest. Keep attestation enabled for confidential inference.

3. Select an enabled model

curl http://127.0.0.1:8787/v1/models \
  -H "Authorization: Bearer $PREM_API_KEY"

Use an id returned by this request. The example below uses qwen36-27b. Test it before starting OpenClaw:

curl http://127.0.0.1:8787/v1/chat/completions \
  -H "Authorization: Bearer $PREM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "qwen36-27b",
    "messages": [{"role": "user", "content": "Reply with OK."}],
    "stream": false
  }'

4. Configure OpenClaw

OpenClaw reads JSON5 from ~/.openclaw/openclaw.json. Add a custom provider:

{
  "models": {
    "mode": "merge",
    "providers": {
      "prem-confidential": {
        "baseUrl": "http://127.0.0.1:8787/v1",
        "apiKey": "${PREM_API_KEY}",
        "api": "openai-completions",
        "timeoutSeconds": 600,
        "models": [
          {
            "id": "qwen36-27b",
            "name": "Qwen 3.6 27B through Prem",
            "reasoning": true,
            "input": ["text"],
            "contextWindow": 131072,
            "maxTokens": 8192
          }
        ]
      }
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "prem-confidential/qwen36-27b"
      }
    }
  }
}

The provider must use api: "openai-completions". The Confidential Proxy does not expose /v1/responses. OpenClaw allows the exact baseUrl origin in its guarded model-request path. See the OpenClaw custom-provider reference. Validate the file:

openclaw config validate

5. Run one agent turn

Run a bounded local turn before connecting channels or schedules:

openclaw agent \
  --local \
  --agent main \
  --message "Reply with exactly OK." \
  --json

Inspect the returned provider and model. They should identify prem-confidential and the model you configured. OpenClaw can stream model output through the Chat Completions connection. Tool calls return through the encrypted model channel, but OpenClaw executes each tool in its local environment.

Tool and channel boundary

Component	Plaintext access	Notes
OpenClaw	Yes	Reads prompts, channel messages, memory, and tool results
Confidential Proxy	Yes, locally	Encrypts model requests and decrypts responses
Prem API Gateway	No content access	Receives ciphertext and operational metadata
Prem confidential runtime	Yes, inside the protected runtime	Runs inference and encrypts the result
Channel, plugin, tool, or MCP server	Depends on its function	Uses its own storage, credentials, and network boundary

Review channel allowlists, tool permissions, secret storage, workspace access, and external egress separately.

Agent limits

The encrypted chat endpoint permits one active stream for each API key. Parallel OpenClaw agents using the same key can receive 429 responses. Start with one worker. Serialize model turns or assign a separate Prem API key to each concurrent worker. Review Agents & Automation before enabling unattended schedules or channels.

Troubleshooting

OpenClaw rejects the configuration

Run openclaw config validate. Check the field names and confirm that api is openai-completions.

OpenClaw calls /v1/responses

The provider is using the wrong adapter. Set api to openai-completions and restart the affected agent process.

The provider cannot reach 127.0.0.1:8787

Confirm that the Confidential Proxy is running in the same host environment. A container or remote OpenClaw worker needs a reachable proxy address instead of its own loopback interface.

The API returns model not found

Call /v1/models with the Prem API key and use a returned model ID in both provider locations.

The API returns 429

Wait for the current stream to finish. Reduce parallel agent turns or use separate API keys for concurrent workers.

Frequently asked questions

Is OpenClaw running inside the enclave?

No. OpenClaw runs on your machine. Only supported model inference traffic passes through the encrypted Prem path.

Does OpenClaw need the Prem TypeScript SDK?

No. It calls the OpenAI-compatible surface exposed by the local proxy.

Can OpenClaw use tools through this setup?

Yes, when the selected model produces compatible tool calls. OpenClaw executes those tools outside the enclave.

Can I expose the proxy to a remote OpenClaw host?

Yes, but that changes the local trust boundary. Use TLS, authenticated private networking, a restrictive firewall, and a controlled host binding. Do not expose an unauthenticated plaintext listener to the public internet.

Router

Beta

Router is not confidential. Use this path only for non-sensitive prompts, workspace context, and tool results.

OpenClaw uses Router through a separate openai-completions provider.

export PREM_ROUTER_API_KEY="your-router-api-key"

Confirm that kimi-k3 appears in GET /v1/models for this key. Otherwise, use an exact returned model ID. See Router models. Add a provider named prem-router with these values:

Field	Value
`baseUrl`	`https://router.prem.io/v1`
`apiKey`	`${PREM_ROUTER_API_KEY}`
`api`	`openai-completions`
First model ID	`kimi-k3`
Agent model	`prem-router/kimi-k3`

Use the complete JSON in the Router OpenClaw configuration, then run openclaw config validate. Do not start the Confidential Proxy or pass a KEK for this provider.

Confidential Proxy

Review modes, routes, keys, and daemon controls.

OpenAI-compatible clients

Understand the interface used by OpenClaw.

Agents & Automation

Review concurrency, retries, and unattended operation.

Security Model

Review the protected and unprotected parts of the flow.

Get Started

Router

Core Concepts

Handling Errors

Guides

API Reference

Billing

Support

OpenClaw

Confidential API

How the connection works

Before you start

1. Set your secrets

2. Start the Confidential Proxy

3. Select an enabled model

4. Configure OpenClaw

5. Run one agent turn

Tool and channel boundary

Agent limits

Troubleshooting

Frequently asked questions

Is OpenClaw running inside the enclave?

Does OpenClaw need the Prem TypeScript SDK?

Can OpenClaw use tools through this setup?

Can I expose the proxy to a remote OpenClaw host?

Router

Confidential Proxy

OpenAI-compatible clients

Agents & Automation

Security Model

​Confidential API

​How the connection works

​Before you start

​1. Set your secrets

​2. Start the Confidential Proxy

​3. Select an enabled model

​4. Configure OpenClaw

​5. Run one agent turn

​Tool and channel boundary

​Agent limits

​Troubleshooting

​Frequently asked questions

​Is OpenClaw running inside the enclave?

​Does OpenClaw need the Prem TypeScript SDK?

​Can OpenClaw use tools through this setup?

​Can I expose the proxy to a remote OpenClaw host?

​Router

​Related

Confidential Proxy

OpenAI-compatible clients

Agents & Automation

Security Model

Confidential API

How the connection works

Before you start

1. Set your secrets

2. Start the Confidential Proxy

3. Select an enabled model

4. Configure OpenClaw

5. Run one agent turn

Tool and channel boundary

Agent limits

Troubleshooting

Frequently asked questions

Is OpenClaw running inside the enclave?

Does OpenClaw need the Prem TypeScript SDK?

Can OpenClaw use tools through this setup?

Can I expose the proxy to a remote OpenClaw host?

Router

Related