❯ Bring your own LLM key without babysitting every agent's config

2026-09-11 · ai agents, openclaw, hermes, byo ·2 min read min read

You have a box running OpenClaw and Hermes. You want model calls billed to your own OpenRouter account — your spend caps, your invoice, your provider relationship. So you SSH in to set the key.

And that's where it gets annoying, because now you're editing the same credential into more than one place, restarting more than one service, and quietly hoping you didn't miss the one the other agent reads.

That is the actual problem with "bring your own key." Not the key. The drift.

Two agents, one credential, three env vars

On this stack the agents don't read a shared secret vault out of the box — they read environment. Concretely, the provider key lives in /opt/sqs-voice/.env and is exposed under three names: OPENROUTER_API_KEY, OPENCLAW_ADMIN_OPENROUTER_API_KEY, and HERMES_OPENROUTER_API_KEY. Set one and forget the others and you get the classic half-configured state: one agent billing you, the other still billing someone else, and no obvious symptom until the numbers look wrong.

Do it by hand and the checklist is: edit the file, hit all three variables, force-recreate the stack so the new .env actually loads (a plain docker restart reuses the old container env — a trap), and restart the gateway. Miss the recreate step and you have "changed" the key into a file that nothing is reading.

What "standardized" should mean

One action, every agent, and it actually takes effect. That is what the Agent Wizard now does for BYO keys. You pick the claw, paste the key, and the platform writes it into all three variables and recreates the stack so it loads. OpenClaw and Hermes end up on the same key because the same value went to the same place — not because you were careful.

Your included Claw Way budget stays in place as a fallback, so an agent doesn't go dark mid-task because a personal key hit its own limit. Push Use included and you're back on the plan budget; nothing else about the server changes.

How to run it

  1. Sign in to the hub at hub.sqs.chat.
  2. Open Dashboard → Agents → Wizard (/dashboard/agents/wizard/).
  3. Find the Model credentials — bring your own API key card, pick the claw, paste the key, press Use my key.

The key goes to the vault encrypted and is never shown again. No copy sits in a config file you have to remember to scrub later.

The fine print, because you'll ask

  • Plans: the Wizard's model-capacity step is built for Pro and Agency claws. Starter is the single-agent entry plan and isn't wired into the Wizard.
  • Availability: the Wizard is rolling out in closed beta. If the tile isn't on your dashboard yet, it's coming.
  • Key type: OpenRouter-compatible providers today. A raw OpenAI or Anthropic endpoint needs a base-URL option, which is on the roadmap.
  • Reversible: Use included restores the plan key and allowance at any time.

Fewer moving parts, one credential, and no archaeology next month when you need to know whose account is being billed. That's the whole point.

References

by Mara Vega — the AI desk, Side Quest Studios
AI-assisted, curated for Side Quest Studios.

© 2026 Terminal King