API Key Security

BYOK: Your keys, your server

OneClickClaw uses a Bring Your Own Key (BYOK) model. Every plan runs on an AI account that you own. You connect it in one of two ways:

• Sign in with a subscription you already pay for. On OpenClaw: a ChatGPT plan (Plus or higher) or SuperGrok / X Premium+. On Hermes Agent: those two, plus Nous Portal and MiniMax.
• Paste an API key from your AI provider (OpenAI, Anthropic, Google, OpenRouter and many more). Claude works with an Anthropic API key.

Either way, the key or sign-in lives on your dedicated server, where your agent uses it to talk to your AI provider directly. You keep full ownership of your AI account and your AI spending.

Where your keys are stored

When you connect a model on OpenClaw (Settings > Models > Connect provider), OpenClaw writes the key or sign-in into its own configuration on your server. Hermes Agent does the same in its own configuration on your server. Your agent needs the key in readable form to call your provider, so these files are protected by the server's file permissions.

Some keys also pass through OneClickClaw itself, for example on servers that were set up through our earlier setup screens, or when you hand a new key to our support assistant so it can put it on your server. For those we keep a copy in our database, so the key can be put back on the server after a repair. That copy, and the other credentials OneClickClaw keeps to operate your server (such as the gateway password), are encrypted with Fernet symmetric encryption (AES-128-CBC + HMAC-SHA256) before they reach our database. Most of that copy is removed when the server is destroyed. Ask support to remove anything left over.

Who has access to your keys

Your agent uses your key on your own server to call your AI provider. Because we manage that server for you, our team and our automation have administrator access to it, which we use for repairs, updates, and the security checks described in Monitoring explained.

On a newly built Hermes Agent server, the agent itself runs as an ordinary user without administrator rights.

How to rotate your API key

Rotating your API key regularly is a security best practice. Follow these steps:

What to do if a key is compromised

If you believe your API key has been leaked or used without authorization, your agent stops working with the compromised key as soon as you revoke it. Act immediately:

• Revoke the key immediately in your AI provider's dashboard. This stops all usage of that key, including any unauthorized usage.
• Generate a new key from the same provider dashboard.
• Connect the new key inside your agent, as in step 2 above.
• Review your provider's usage logs for any unexpected charges or activity during the exposure window.

Credential fingerprint

For some connections we keep a credential fingerprint: a one-way code. For a sign-in it is made from the provider name alone. For a key that passed through our earlier setup screens it is made from the provider name and the key. The key cannot be read back from it. We use it on our side, for example to know which servers are signed in to xAI (Grok), so that an hourly check can warn you in your notification bell before that sign-in expires.

Setting spending limits

Your API key connects directly to your AI provider's billing. To protect yourself from unexpected costs, set spending limits directly in your AI provider's account settings. Most providers offer monthly budget caps, per-request limits, or usage alerts.

For more details on how BYOK works, see BYOK Explained. To configure your AI provider, see Setting Up Your AI Provider.