> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prem.io/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenClaw

> Connect OpenClaw to Prem API through the local Confidential Proxy.

OpenClaw can use Prem API as a custom OpenAI-compatible provider. OpenClaw sends Chat Completions requests to the local Confidential Proxy, which encrypts them before network egress.

> [!WARNING]
>
> OpenClaw, its workspace, channels, local tools, plugins, and MCP servers remain outside the Prem confidential runtime. This setup protects supported model traffic, not the complete agent.

> [tab] Confidential API
>
> Use the local Confidential Proxy for sensitive model traffic. [Go to the confidential setup](#confidential-api-setup).

> [tab] ZDR
>
> Use Zero Data Retention (ZDR) for OpenAI-compatible inference with non-sensitive data. [Go to the ZDR setup](#zdr-setup).

## Confidential API setup

This path uses the local Confidential Proxy to encrypt your prompts end-to-end before they leave your machine.

## How the connection works

```mermaid theme={"system"}
flowchart TB
    subgraph Local["Your machine: plaintext is available"]
        O["OpenClaw"] -->|"OpenAI Chat Completions"| P["Confidential Proxy<br/>127.0.0.1:8787/v1"]
        T["Workspace, tools, channels, and MCP"] <--> O
    end

    P -->|"Encrypt before network egress"| G["Prem API Gateway<br/>ciphertext and metadata"]
    G -->|"Encrypted request"| E["Prem confidential runtime<br/>decrypt, infer, encrypt"]
    E -.->|"Encrypted response"| P
    P -.->|"OpenAI-compatible response"| O
```

## Before you start

You need:

* OpenClaw installed. See the [OpenClaw setup guide](https://docs.openclaw.ai/start/setup).
* A Prem API key. See [API Keys](https://docs.prem.io/api-keys.md).
* A 32-byte client KEK encoded as 64 hexadecimal characters.
* The current Prem gateway and enclave endpoints.
* A chat model returned by your Prem model-list request.

Check the installed version:

```bash theme={"system"}
openclaw --version
```

This configuration has been exercised with OpenClaw `2026.7.1-2` using a normal agent turn and a local file-reading tool call.

## 1. Set your secrets

```bash theme={"system"}
export PREM_API_KEY="your-prem-api-key"
export CLIENT_KEK="your-64-character-hex-kek"
export PROXY_URL="https://gateway.prem.io"
export ENCLAVE_URL="https://conf-engine.prem.io"
```

Generate the KEK once if you do not have one:

```bash theme={"system"}
openssl rand -hex 32
```

Store the KEK in a secret manager. Do not place either secret in `openclaw.json` as a literal value.

## 2. Start the Confidential Proxy

```bash theme={"system"}
npx -p @premai/api-sdk@1.0.70 confidential-proxy \
  --host 127.0.0.1 \
  --port 8787 \
  --compat openai \
  --kek "$CLIENT_KEK"
```

> [!WARNING]
>
> Do not use `--no-attest`. Keep attestation enabled for confidential inference.

## 3. Select an enabled model

```bash theme={"system"}
curl http://127.0.0.1:8787/v1/models \
  -H "Authorization: Bearer $PREM_API_KEY"
```

Use an `id` returned by this request. The example below uses `qwen38-27b`.

Test it before starting OpenClaw:

```bash theme={"system"}
curl http://127.0.0.1:8787/v1/chat/completions \
  -H "Authorization: Bearer $PREM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "qwen38-27b",
    "messages": [{"role": "user", "content": "Reply with OK."}],
    "stream": false
  }'
```

## 4. Configure OpenClaw

OpenClaw reads JSON5 from `~/.openclaw/openclaw.json`. Add a custom provider:

```json theme={"system"}
{
  "models": {
    "mode": "merge",
    "providers": {
      "prem-confidential": {
        "baseUrl": "http://127.0.0.1:8787/v1",
        "apiKey": "${PREM_API_KEY}",
        "api": "openai-completions",
        "timeoutSeconds": 600,
        "models": [
          {
            "id": "qwen38-27b",
            "name": "Qwen 3.8 27B through Prem",
            "reasoning": true,
            "input": ["text"],
            "contextWindow": 131072,
            "maxTokens": 8192
          }
        ]
      }
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "prem-confidential/qwen38-27b"
      }
    }
  }
}
```

The provider must use `api: "openai-completions"`. The Confidential Proxy does not expose `/v1/responses`.

OpenClaw allows the exact `baseUrl` origin in its guarded model-request path. See the [OpenClaw custom-provider reference](https://docs.openclaw.ai/gateway/config-tools#custom-providers-and-base-urls).

Validate the file:

```bash theme={"system"}
openclaw config validate
```

## 5. Run one agent turn

Run a bounded local turn before connecting channels or schedules:

```bash theme={"system"}
openclaw agent \
  --local \
  --agent main \
  --message "Reply with exactly OK." \
  --json
```

Inspect the returned provider and model. They should identify `prem-confidential` and the model you configured.

OpenClaw can stream model output through the Chat Completions connection. Tool calls return through the encrypted model channel, but OpenClaw executes each tool in its local environment.

## Tool and channel boundary

| Component | Plaintext access | Notes |
| - | - | - |
| OpenClaw | Yes | Reads prompts, channel messages, memory, and tool results |
| Confidential Proxy | Yes, locally | Encrypts model requests and decrypts responses |
| Prem API Gateway | No content access | Receives ciphertext and operational metadata |
| Prem confidential runtime | Yes, inside the protected runtime | Runs inference and encrypts the result |
| Channel, plugin, tool, or MCP server | Depends on its function | Uses its own storage, credentials, and network boundary |

Review channel allowlists, tool permissions, secret storage, workspace access, and external egress separately.

## Agent limits

Each API key can run a limited number of requests at the same time, set by your [tier](https://docs.prem.io/tiers.md#concurrent-requests). The encrypted chat endpoint always streams, and each call holds a slot until its stream closes. Parallel OpenClaw agents using the same key can receive `429` responses when they exceed that limit.

Start with one worker. Serialize model turns or assign a separate Prem API key to each concurrent worker. Review [Agents & Automation](https://docs.prem.io/agents.md) before enabling unattended schedules or channels.

## Troubleshooting

> [accordion] OpenClaw rejects the configuration
>
> Run `openclaw config validate`. Check the field names and confirm that `api` is `openai-completions`.

> [accordion] OpenClaw calls /v1/responses
>
> The provider is using the wrong adapter. Set `api` to `openai-completions` and restart the affected agent process.

> [accordion] The provider cannot reach 127.0.0.1:8787
>
> Confirm that the Confidential Proxy is running in the same host environment. A container or remote OpenClaw worker needs a reachable proxy address instead of its own loopback interface.

> [accordion] The API returns model not found
>
> Call `/v1/models` with the Prem API key and use a returned model ID in both provider locations.

> [accordion] The API returns 429
>
> Wait for active streams to finish. Reduce parallel agent turns or use separate API keys for concurrent workers.

## Frequently asked questions

### Is OpenClaw running inside the enclave?

No. OpenClaw runs on your machine. Only supported model inference traffic passes through the encrypted Prem path.

### Does OpenClaw need the Prem TypeScript SDK?

No. It calls the OpenAI-compatible surface exposed by the local proxy.

### Can OpenClaw use tools through this setup?

Yes, when the selected model produces compatible tool calls. OpenClaw executes those tools outside the enclave.

### Can I expose the proxy to a remote OpenClaw host?

Yes, but that changes the local trust boundary. Use TLS, authenticated private networking, a restrictive firewall, and a controlled host binding. Do not expose an unauthenticated plaintext listener to the public internet.

## ZDR setup

> [!WARNING]
>
> ZDR is not confidential. Use this path only for non-sensitive prompts,
> workspace context, and tool results.

OpenClaw uses ZDR through a separate `openai-completions` provider.

## 1. Set your API key

```bash theme={"system"}
export PREM_API_KEY="your-prem-api-key"
```

## 2. Configure OpenClaw

Add the `prem-zdr` provider to `~/.openclaw/openclaw.json`:

```json theme={"system"}
{
  "models": {
    "mode": "merge",
    "providers": {
      "prem-zdr": {
        "baseUrl": "https://gateway.prem.io/openai",
        "apiKey": "${PREM_API_KEY}",
        "api": "openai-completions",
        "timeoutSeconds": 600,
        "models": [
          {
            "id": "kimi-k3",
            "name": "Kimi K3 (ZDR)"
          }
        ]
      }
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "prem-zdr/kimi-k3"
      }
    }
  }
}
```

The provider must use `api: "openai-completions"`. Confirm that `kimi-k3` appears in
`GET /openai/models` for this key and use an exact returned `id` in both the `models`
entry and the agent `primary`. Otherwise, use an exact returned model ID. See
[Models & Pricing](https://docs.prem.io/models-and-pricing.md).

Add `reasoning`, `contextWindow`, and `maxTokens` to the `models` entry when you set
model-specific values, as in the Confidential API setup above.

Validate the file:

```bash theme={"system"}
openclaw config validate
```

## 3. Verify

Run a bounded local turn before connecting channels or schedules:

```bash theme={"system"}
openclaw agent \
  --local \
  --agent main \
  --message "Reply with exactly: zdr ok" \
  --json
```

Inspect the returned provider and model. It should identify `prem-zdr` and `kimi-k3`.
Do not start the Confidential Proxy or pass a KEK for this provider.

## Related

> [card] [Confidential Proxy](https://docs.prem.io/confidential-proxy.md)
>
> Review modes, routes, keys, and daemon controls.

> [card] [OpenAI-compatible clients](https://docs.prem.io/guides/openai-compatible-clients.md)
>
> Understand the interface used by OpenClaw.

> [card] [Agents & Automation](https://docs.prem.io/agents.md)
>
> Review concurrency, retries, and unattended operation.

> [card] [Security Model](https://docs.prem.io/security-model.md)
>
> Review the protected and unprotected parts of the flow.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.