> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prem.io/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenClaw

> Connect OpenClaw to Prem API through the local Confidential Proxy.

OpenClaw can use Prem API as a custom OpenAI-compatible provider. OpenClaw sends Chat Completions requests to the local Confidential Proxy, which encrypts them before network egress.

<Warning>
  OpenClaw, its workspace, channels, local tools, plugins, and MCP servers remain outside the Prem confidential runtime. This setup protects supported model traffic, not the complete agent.
</Warning>

<Tabs>
  <Tab title="Confidential API">
    Use the local Confidential Proxy for sensitive model traffic. [Go to the confidential setup](#confidential-api).
  </Tab>

  <Tab title="Router (Beta)">
    <Badge color="blue">Beta</Badge>

    Use Router for its broader model catalog with non-sensitive data. [Go to the Router setup](#router).
  </Tab>
</Tabs>

## Confidential API

## How the connection works

```mermaid theme={"system"}
flowchart TB
    subgraph Local["Your machine: plaintext is available"]
        O["OpenClaw"] -->|"OpenAI Chat Completions"| P["Confidential Proxy<br/>127.0.0.1:8787/v1"]
        T["Workspace, tools, channels, and MCP"] <--> O
    end

    P -->|"Encrypt before network egress"| G["Prem API Gateway<br/>ciphertext and metadata"]
    G -->|"Encrypted request"| E["Prem confidential runtime<br/>decrypt, infer, encrypt"]
    E -.->|"Encrypted response"| P
    P -.->|"OpenAI-compatible response"| O
```

## Before you start

You need:

* OpenClaw installed. See the [OpenClaw setup guide](https://docs.openclaw.ai/start/setup).
* A Prem API key. See [API Keys](/api-keys).
* A 32-byte client KEK encoded as 64 hexadecimal characters.
* The current Prem gateway and enclave endpoints.
* A chat model returned by your Prem model-list request.

Check the installed version:

```bash theme={"system"}
openclaw --version
```

This configuration has been exercised with OpenClaw `2026.7.1-2` using a normal agent turn and a local file-reading tool call.

## 1. Set your secrets

```bash theme={"system"}
export PREM_API_KEY="your-prem-api-key"
export CLIENT_KEK="your-64-character-hex-kek"
export PROXY_URL="https://gateway.prem.io"
export ENCLAVE_URL="https://conf-engine.prem.io"
```

Generate the KEK once if you do not have one:

```bash theme={"system"}
openssl rand -hex 32
```

Store the KEK in a secret manager. Do not place either secret in `openclaw.json` as a literal value.

## 2. Start the Confidential Proxy

```bash theme={"system"}
npx -p @premai/api-sdk@1.0.59 confidential-proxy \
  --host 127.0.0.1 \
  --port 8787 \
  --compat openai \
  --kek "$CLIENT_KEK"
```

<Warning>
  Do not use `--no-attest`. Keep attestation enabled for confidential inference.
</Warning>

## 3. Select an enabled model

```bash theme={"system"}
curl http://127.0.0.1:8787/v1/models \
  -H "Authorization: Bearer $PREM_API_KEY"
```

Use an `id` returned by this request. The example below uses `qwen36-27b`.

Test it before starting OpenClaw:

```bash theme={"system"}
curl http://127.0.0.1:8787/v1/chat/completions \
  -H "Authorization: Bearer $PREM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "qwen36-27b",
    "messages": [{"role": "user", "content": "Reply with OK."}],
    "stream": false
  }'
```

## 4. Configure OpenClaw

OpenClaw reads JSON5 from `~/.openclaw/openclaw.json`. Add a custom provider:

```json theme={"system"}
{
  "models": {
    "mode": "merge",
    "providers": {
      "prem-confidential": {
        "baseUrl": "http://127.0.0.1:8787/v1",
        "apiKey": "${PREM_API_KEY}",
        "api": "openai-completions",
        "timeoutSeconds": 600,
        "models": [
          {
            "id": "qwen36-27b",
            "name": "Qwen 3.6 27B through Prem",
            "reasoning": true,
            "input": ["text"],
            "contextWindow": 131072,
            "maxTokens": 8192
          }
        ]
      }
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "prem-confidential/qwen36-27b"
      }
    }
  }
}
```

The provider must use `api: "openai-completions"`. The Confidential Proxy does not expose `/v1/responses`.

OpenClaw allows the exact `baseUrl` origin in its guarded model-request path. See the [OpenClaw custom-provider reference](https://docs.openclaw.ai/gateway/config-tools#custom-providers-and-base-urls).

Validate the file:

```bash theme={"system"}
openclaw config validate
```

## 5. Run one agent turn

Run a bounded local turn before connecting channels or schedules:

```bash theme={"system"}
openclaw agent \
  --local \
  --agent main \
  --message "Reply with exactly OK." \
  --json
```

Inspect the returned provider and model. They should identify `prem-confidential` and the model you configured.

OpenClaw can stream model output through the Chat Completions connection. Tool calls return through the encrypted model channel, but OpenClaw executes each tool in its local environment.

## Tool and channel boundary

| Component                            | Plaintext access                  | Notes                                                     |
| ------------------------------------ | --------------------------------- | --------------------------------------------------------- |
| OpenClaw                             | Yes                               | Reads prompts, channel messages, memory, and tool results |
| Confidential Proxy                   | Yes, locally                      | Encrypts model requests and decrypts responses            |
| Prem API Gateway                     | No content access                 | Receives ciphertext and operational metadata              |
| Prem confidential runtime            | Yes, inside the protected runtime | Runs inference and encrypts the result                    |
| Channel, plugin, tool, or MCP server | Depends on its function           | Uses its own storage, credentials, and network boundary   |

Review channel allowlists, tool permissions, secret storage, workspace access, and external egress separately.

## Agent limits

The encrypted chat endpoint permits one active stream for each API key. Parallel OpenClaw agents using the same key can receive `429` responses.

Start with one worker. Serialize model turns or assign a separate Prem API key to each concurrent worker. Review [Agents & Automation](/agents) before enabling unattended schedules or channels.

## Troubleshooting

<AccordionGroup>
  <Accordion title="OpenClaw rejects the configuration">
    Run `openclaw config validate`. Check the field names and confirm that `api` is `openai-completions`.
  </Accordion>

  <Accordion title="OpenClaw calls /v1/responses">
    The provider is using the wrong adapter. Set `api` to `openai-completions` and restart the affected agent process.
  </Accordion>

  <Accordion title="The provider cannot reach 127.0.0.1:8787">
    Confirm that the Confidential Proxy is running in the same host environment. A container or remote OpenClaw worker needs a reachable proxy address instead of its own loopback interface.
  </Accordion>

  <Accordion title="The API returns model not found">
    Call `/v1/models` with the Prem API key and use a returned model ID in both provider locations.
  </Accordion>

  <Accordion title="The API returns 429">
    Wait for the current stream to finish. Reduce parallel agent turns or use separate API keys for concurrent workers.
  </Accordion>
</AccordionGroup>

## Frequently asked questions

### Is OpenClaw running inside the enclave?

No. OpenClaw runs on your machine. Only supported model inference traffic passes through the encrypted Prem path.

### Does OpenClaw need the Prem TypeScript SDK?

No. It calls the OpenAI-compatible surface exposed by the local proxy.

### Can OpenClaw use tools through this setup?

Yes, when the selected model produces compatible tool calls. OpenClaw executes those tools outside the enclave.

### Can I expose the proxy to a remote OpenClaw host?

Yes, but that changes the local trust boundary. Use TLS, authenticated private networking, a restrictive firewall, and a controlled host binding. Do not expose an unauthenticated plaintext listener to the public internet.

## Router

<Badge color="blue">Beta</Badge>

<Warning>
  Router is not confidential. Use this path only for non-sensitive prompts,
  workspace context, and tool results.
</Warning>

OpenClaw uses Router through a separate `openai-completions` provider.

```bash theme={"system"}
export PREM_ROUTER_API_KEY="your-router-api-key"
```

Confirm that `kimi-k3` appears in `GET /v1/models` for this key. Otherwise, use
an exact returned model ID. See [Router models](/router/models).

Add a provider named `prem-router` with these values:

| Field          | Value                       |
| -------------- | --------------------------- |
| `baseUrl`      | `https://router.prem.io/v1` |
| `apiKey`       | `${PREM_ROUTER_API_KEY}`    |
| `api`          | `openai-completions`        |
| First model ID | `kimi-k3`                   |
| Agent model    | `prem-router/kimi-k3`       |

Use the complete JSON in the [Router OpenClaw configuration](/router/integrations#openclaw), then run `openclaw config validate`. Do not start the Confidential Proxy or pass a KEK for this provider.

## Related

<CardGroup cols={2}>
  <Card title="Confidential Proxy" icon="server" href="/confidential-proxy" arrow="true">
    Review modes, routes, keys, and daemon controls.
  </Card>

  <Card title="OpenAI-compatible clients" icon="code" href="/guides/openai-compatible-clients" arrow="true">
    Understand the interface used by OpenClaw.
  </Card>

  <Card title="Agents & Automation" icon="robot" href="/agents" arrow="true">
    Review concurrency, retries, and unattended operation.
  </Card>

  <Card title="Security Model" icon="shield-halved" href="/security-model" arrow="true">
    Review the protected and unprotected parts of the flow.
  </Card>
</CardGroup>