{
  "title": "Authentication",
  "content": "OpenClaw supports OAuth and API keys for model providers. For Anthropic\naccounts, we recommend using an **API key**. For Claude subscription access,\nuse the long‑lived token created by `claude setup-token`.\n\nSee [/concepts/oauth](/concepts/oauth) for the full OAuth flow and storage\nlayout.\n\n## Recommended Anthropic setup (API key)\n\nIf you’re using Anthropic directly, use an API key.\n\n1. Create an API key in the Anthropic Console.\n2. Put it on the **gateway host** (the machine running `openclaw gateway`).\n\n3. If the Gateway runs under systemd/launchd, prefer putting the key in\n   `~/.openclaw/.env` so the daemon can read it:\n\nThen restart the daemon (or restart your Gateway process) and re-check:\n\nIf you’d rather not manage env vars yourself, the onboarding wizard can store\nAPI keys for daemon use: `openclaw onboard`.\n\nSee [Help](/help) for details on env inheritance (`env.shellEnv`,\n`~/.openclaw/.env`, systemd/launchd).\n\n## Anthropic: setup-token (subscription auth)\n\nFor Anthropic, the recommended path is an **API key**. If you’re using a Claude\nsubscription, the setup-token flow is also supported. Run it on the **gateway host**:\n\nThen paste it into OpenClaw:\n\nIf the token was created on another machine, paste it manually:\n\nIf you see an Anthropic error like:\n\n…use an Anthropic API key instead.\n\nManual token entry (any provider; writes `auth-profiles.json` + updates config):\n\nAutomation-friendly check (exit `1` when expired/missing, `2` when expiring):\n\nOptional ops scripts (systemd/Termux) are documented here:\n[/automation/auth-monitoring](/automation/auth-monitoring)\n\n> `claude setup-token` requires an interactive TTY.\n\n## Checking model auth status\n\n## Controlling which credential is used\n\n### Per-session (chat command)\n\nUse `/model <alias-or-id>@<profileId>` to pin a specific provider credential for the current session (example profile ids: `anthropic:default`, `anthropic:work`).\n\nUse `/model` (or `/model list`) for a compact picker; use `/model status` for the full view (candidates + next auth profile, plus provider endpoint details when configured).\n\n### Per-agent (CLI override)\n\nSet an explicit auth profile order override for an agent (stored in that agent’s `auth-profiles.json`):\n\nUse `--agent <id>` to target a specific agent; omit it to use the configured default agent.\n\n### “No credentials found”\n\nIf the Anthropic token profile is missing, run `claude setup-token` on the\n**gateway host**, then re-check:\n\n### Token expiring/expired\n\nRun `openclaw models status` to confirm which profile is expiring. If the profile\nis missing, rerun `claude setup-token` and paste the token again.\n\n* Claude Max or Pro subscription (for `claude setup-token`)\n* Claude Code CLI installed (`claude` command available)",
  "code_samples": [
    {
      "code": "3. If the Gateway runs under systemd/launchd, prefer putting the key in\n   `~/.openclaw/.env` so the daemon can read it:",
      "language": "unknown"
    },
    {
      "code": "Then restart the daemon (or restart your Gateway process) and re-check:",
      "language": "unknown"
    },
    {
      "code": "If you’d rather not manage env vars yourself, the onboarding wizard can store\nAPI keys for daemon use: `openclaw onboard`.\n\nSee [Help](/help) for details on env inheritance (`env.shellEnv`,\n`~/.openclaw/.env`, systemd/launchd).\n\n## Anthropic: setup-token (subscription auth)\n\nFor Anthropic, the recommended path is an **API key**. If you’re using a Claude\nsubscription, the setup-token flow is also supported. Run it on the **gateway host**:",
      "language": "unknown"
    },
    {
      "code": "Then paste it into OpenClaw:",
      "language": "unknown"
    },
    {
      "code": "If the token was created on another machine, paste it manually:",
      "language": "unknown"
    },
    {
      "code": "If you see an Anthropic error like:",
      "language": "unknown"
    },
    {
      "code": "…use an Anthropic API key instead.\n\nManual token entry (any provider; writes `auth-profiles.json` + updates config):",
      "language": "unknown"
    },
    {
      "code": "Automation-friendly check (exit `1` when expired/missing, `2` when expiring):",
      "language": "unknown"
    },
    {
      "code": "Optional ops scripts (systemd/Termux) are documented here:\n[/automation/auth-monitoring](/automation/auth-monitoring)\n\n> `claude setup-token` requires an interactive TTY.\n\n## Checking model auth status",
      "language": "unknown"
    },
    {
      "code": "## Controlling which credential is used\n\n### Per-session (chat command)\n\nUse `/model <alias-or-id>@<profileId>` to pin a specific provider credential for the current session (example profile ids: `anthropic:default`, `anthropic:work`).\n\nUse `/model` (or `/model list`) for a compact picker; use `/model status` for the full view (candidates + next auth profile, plus provider endpoint details when configured).\n\n### Per-agent (CLI override)\n\nSet an explicit auth profile order override for an agent (stored in that agent’s `auth-profiles.json`):",
      "language": "unknown"
    },
    {
      "code": "Use `--agent <id>` to target a specific agent; omit it to use the configured default agent.\n\n## Troubleshooting\n\n### “No credentials found”\n\nIf the Anthropic token profile is missing, run `claude setup-token` on the\n**gateway host**, then re-check:",
      "language": "unknown"
    }
  ],
  "headings": [
    {
      "level": "h2",
      "text": "Recommended Anthropic setup (API key)",
      "id": "recommended-anthropic-setup-(api-key)"
    },
    {
      "level": "h2",
      "text": "Anthropic: setup-token (subscription auth)",
      "id": "anthropic:-setup-token-(subscription-auth)"
    },
    {
      "level": "h2",
      "text": "Checking model auth status",
      "id": "checking-model-auth-status"
    },
    {
      "level": "h2",
      "text": "Controlling which credential is used",
      "id": "controlling-which-credential-is-used"
    },
    {
      "level": "h3",
      "text": "Per-session (chat command)",
      "id": "per-session-(chat-command)"
    },
    {
      "level": "h3",
      "text": "Per-agent (CLI override)",
      "id": "per-agent-(cli-override)"
    },
    {
      "level": "h2",
      "text": "Troubleshooting",
      "id": "troubleshooting"
    },
    {
      "level": "h3",
      "text": "“No credentials found”",
      "id": "“no-credentials-found”"
    },
    {
      "level": "h3",
      "text": "Token expiring/expired",
      "id": "token-expiring/expired"
    },
    {
      "level": "h2",
      "text": "Requirements",
      "id": "requirements"
    }
  ],
  "url": "llms-txt#authentication",
  "links": []
}