OpenClaw

Local gateway assistant with a custom Guard provider.

Model protocol

Claude, Kimi, Composer and Grok

OpenClaw is a local gateway assistant: it installs on your own machine and decides for itself which model provider to call. A third-party address and key are described in its own configuration.

bash

npm install -g openclaw@latest --allow-scripts=openclaw

Settings live in ~/.openclaw/openclaw.json, JSON5 with comments, and the gateway re-reads the file on its own. Your address goes into the models.providers section: the baseUrl, apiKey and api fields plus a model list. The api field picks the protocol; without it openai-completions is used.

json5

// ~/.openclaw/openclaw.json
{
  models: {
    mode: "merge",
    providers: {
      guard: {
        baseUrl: "https://api.guardrelay.ai/v1",
        apiKey: "${GUARD_API_KEY}",
        api: "openai-completions",
        models: [{ id: "claude-sonnet-5-5", name: "Claude Sonnet 5.5" }],
      },
    },
  },
  agents: { defaults: { model: { primary: "guard/claude-sonnet-5-5" } } },
}

json5

// ~/.openclaw/openclaw.json
{
  models: {
    mode: "merge",
    providers: {
      guard: {
        baseUrl: "https://api.guardrelay.ai/v1",
        apiKey: "${GUARD_API_KEY}",
        api: "openai-completions",
        models: [{ id: "k3", name: "Kimi K3", maxTokens: 8192 }],
      },
    },
  },
  agents: { defaults: { model: { primary: "guard/k3" } } },
}

json5

// ~/.openclaw/openclaw.json
{
  models: {
    mode: "merge",
    providers: {
      guard: {
        baseUrl: "https://api.guardrelay.ai/v1",
        apiKey: "${GUARD_API_KEY}",
        api: "openai-completions",
        models: [{ id: "cursor-grok-4.7-high", name: "Grok 4.7", contextWindow: 256000, maxTokens: 8192 }],
      },
    },
  },
  agents: { defaults: { model: { primary: "guard/cursor-grok-4.7-high" } } },
}

json5

// ~/.openclaw/openclaw.json
{
  models: {
    mode: "merge",
    providers: {
      guard: {
        baseUrl: "https://api.guardrelay.ai/v1",
        apiKey: "${GUARD_API_KEY}",
        api: "openai-completions",
        models: [{ id: "composer-2.5", name: "Composer 2.5", maxTokens: 8192 }],
      },
    },
  },
  agents: { defaults: { model: { primary: "guard/composer-2.5" } } },
}

A model is named as a provider and model pair, so primary carries guard/ plus the exact id. The default can also be changed with openclaw models set guard/<exact id>, and openclaw models list shows what was picked up.

The contextWindow, cost, input and reasoning fields on a model are optional. Without contextWindow the window stays unknown and the client budgets against its own fallback, so it is better to state it. The key can stay as the ${GUARD_API_KEY} substitution: the value is then taken from the environment or from ~/.openclaw/.env.

The same key also works over the Anthropic Messages protocol: put anthropic-messages in api, and then write the address without /v1, because the client appends the version itself. For Guard the variant above is enough.

For Kimi keep openai-completions, and then /v1 in the address is required.

GLM 5.3 in OpenClaw

Install OpenClaw

Use the official installation guide. The commands below skip channel onboarding because a local conversation does not need it.

bash

curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard
openclaw --version

powershell

& ([scriptblock]::Create((iwr -useb https://openclaw.ai/install.ps1))) -NoOnboard
openclaw --version

Get a Guard key

Get a universal gd-… key from the direct API link in @guardapi and choose an API package. Do not put the key in a project, repository, task prompt, or screenshot. Balance and usage are available in your Guard account.

Add the provider and model

Create ~/.openclaw/.env containing GUARD_GLM_API_KEY=gd-your-key.
Open ~/.openclaw/openclaw.json. Add provider guard-glm inside the existing models.providers, keeping channels and other settings.
Use an environment SecretRef and exact api: "openai-responses". Do not enable openai-completions or anthropic-messages for this profile.

dotenv

# ~/.openclaw/.env
GUARD_GLM_API_KEY=gd-your-key

json5

{
  models: {
    mode: "merge",
    providers: {
      "guard-glm": {
        baseUrl: "https://api.guardrelay.ai/glm/v1",
        apiKey: { source: "env", provider: "default", id: "GUARD_GLM_API_KEY" },
        auth: "api-key",
        api: "openai-responses",
        models: [
          { id: "glm-5.3", name: "GLM 5.3" },
          { id: "glm-5.3-flash", name: "GLM 5.3 Flash" }
        ]
      }
    }
  },
  agents: { defaults: { model: { primary: "guard-glm/glm-5.3", fallbacks: [] } } }
}

Check and continue

bash

openclaw config validate
openclaw models list
openclaw agent --local --session-id guard-glm-demo --model guard-glm/glm-5.3 --thinking off --message "Reply with exactly GLM_OK and remember PINE"
openclaw agent --local --session-id guard-glm-demo --model guard-glm/glm-5.3 --thinking off --message "What word were you asked to remember?"

Models and confirmed capabilities

Model ID	When to use it
`glm-5.3`	Default model; text and coding tasks.
`glm-5.3-flash`	Fast model; at API level it accepts PNG and PDF through all three protocols, and MP4 through Chat Completions only.

Responses, local read/write/edit/exec tools, and continuation by session ID are confirmed.
The client itself executes file, edit, and terminal tools. This profile does not connect Z.AI tools or MCP automatically.
This version was checked with text tasks; its attachment button was not checked. Flash capability at API level does not prove that this particular UI can send a file.
The profile uses OpenAI Responses (openai-responses). The GLM server prompt is off by default for ordinary API access; client setup does not enable it.
Native TXT, DOCX, and XLSX are outside the confirmed GLM contract. Use PDF for documents, or PNG with glm-5.3-flash for images.

If the connection fails

Symptom	What to check
`401 invalid_api_key`	The client received the complete active `gd-…` key; the variable is set in the same process that starts the client.
`404 model_not_found`	The model ID is exactly `glm-5.3` or `glm-5.3-flash`; old GLM IDs, aliases, Turbo, and FlashX are unsupported.
`404` or incorrect path	Base URL is `https://api.guardrelay.ai/glm/v1`. The client appends `/responses`; do not add it twice.
`400 invalid_request`	The documented API format is selected; reasoning, temperature, MCP, or other unconfirmed fields were not copied from an older profile.
`402 insufficient_balance`	Check available balance and unfinished reservations in your Guard account.
`config validate` fails	Merge fields into existing objects, check JSON5 commas, and use provider name `guard-glm`.
The model is not found	`openclaw models list` must show the full name `guard-glm/glm-5.3`; select that entry.

Gemini in OpenClaw

Install OpenClaw

Use the official installation guide. The commands below skip channel onboarding because a local conversation does not need it.

bash

curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard
openclaw --version

powershell

& ([scriptblock]::Create((iwr -useb https://openclaw.ai/install.ps1))) -NoOnboard
openclaw --version

Get a Guard key

Add the provider and model

Create ~/.openclaw/.env containing GUARD_GEMINI_API_KEY=gd-your-key.
Open ~/.openclaw/openclaw.json. Add provider guard-gemini inside the existing models.providers, keeping channels and other settings.
Use an environment SecretRef and exact api: "openai-responses". Do not enable openai-completions or anthropic-messages for this profile.

dotenv

# ~/.openclaw/.env
GUARD_GEMINI_API_KEY=gd-your-key

json5

{
  models: {
    mode: "merge",
    providers: {
      "guard-gemini": {
        baseUrl: "https://api.guardrelay.ai/v1",
        apiKey: { source: "env", provider: "default", id: "GUARD_GEMINI_API_KEY" },
        auth: "api-key",
        api: "openai-responses",
        models: [
          { id: "gemini-4-argon", name: "Gemini 4 Argon" },
          { id: "gemini-3.8-flash", name: "Gemini 3.8 Flash" }
        ]
      }
    }
  },
  agents: { defaults: { model: { primary: "guard-gemini/gemini-4-argon", fallbacks: [] } } }
}

Check and continue

bash

openclaw config validate
openclaw models list
openclaw agent --local --session-id guard-gemini-demo --model guard-gemini/gemini-4-argon --message "Reply with exactly GUARD_GEMINI_OK and remember PINE"
openclaw agent --local --session-id guard-gemini-demo --model guard-gemini/gemini-4-argon --message "What word were you asked to remember?"

Gemini models and capabilities

Model ID	Input and window
`gemini-4-argon`	Text, images, PDF; 1,048,576-token window, shared by input and answer.
`gemini-3.8-flash`	Text, images, PDF; 1,048,576-token window for input.

OpenClaw itself executes the local read, write, edit, and exec tools; the conversation continues by session ID.
The Guard catalog takes text, images, and PDF as input and returns text. How to send a file or an image depends on the client's interface; this guide does not describe attachments.
The profile uses OpenAI Responses (openai-responses). The server prompt is a separate setting of the Gemini family: it applies only when the key has the entitlement and the option is on; client setup does not enable it.

If the connection fails

Symptom	What to check
`401 invalid_api_key`	The client received the complete active `gd-…` key; the variable is set in the same process that starts the client.
`404 model_not_found`	The model ID is an exact ID from the table above or the short name `gemini`; other spellings are unsupported.
`404` or incorrect path	Base URL is `https://api.guardrelay.ai/v1`. The client appends `/responses`; do not add it twice.
`400 invalid_request`	The documented API format is selected; extra settings from an older profile were not copied: reasoning, temperature, MCP, and others.
`402 insufficient_credit`	Check available balance and unfinished reservations in your Guard account.
`config validate` fails	Merge fields into existing objects, check JSON5 commas, and use provider name `guard-gemini`.
The model is not found	`openclaw models list` must show the full name `guard-gemini/gemini-4-argon`; select that entry.

Muse in OpenClaw

Install OpenClaw

Use the official installation guide. The commands below skip channel onboarding because a local conversation does not need it.

bash

curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard
openclaw --version

powershell

& ([scriptblock]::Create((iwr -useb https://openclaw.ai/install.ps1))) -NoOnboard
openclaw --version

Get a Guard key

Add the provider and model

Create ~/.openclaw/.env containing GUARD_MUSE_API_KEY=gd-your-key.
Open ~/.openclaw/openclaw.json. Add provider guard-muse inside the existing models.providers, keeping channels and other settings.
Use an environment SecretRef and exact api: "openai-responses". Do not enable openai-completions or anthropic-messages for this profile.

dotenv

# ~/.openclaw/.env
GUARD_MUSE_API_KEY=gd-your-key

json5

{
  models: {
    mode: "merge",
    providers: {
      "guard-muse": {
        baseUrl: "https://api.guardrelay.ai/v1",
        apiKey: { source: "env", provider: "default", id: "GUARD_MUSE_API_KEY" },
        auth: "api-key",
        api: "openai-responses",
        models: [
          { id: "muse-wonder-1.0", name: "Muse Wonder 1.0" },
          { id: "muse-spark-1.3", name: "Muse Spark 1.3" },
          { id: "muse-spark-1.2", name: "Muse Spark 1.2" }
        ]
      }
    }
  },
  agents: { defaults: { model: { primary: "guard-muse/muse-wonder-1.0", fallbacks: [] } } }
}

Check and continue

bash

openclaw config validate
openclaw models list
openclaw agent --local --session-id guard-muse-demo --model guard-muse/muse-wonder-1.0 --message "Reply with exactly GUARD_MUSE_OK and remember PINE"
openclaw agent --local --session-id guard-muse-demo --model guard-muse/muse-wonder-1.0 --message "What word were you asked to remember?"

Muse models and capabilities

Model ID	Input and window
`muse-wonder-1.0`	Text, images, PDF; 1,048,576-token window.
`muse-spark-1.3`	Text, images, PDF; 1,048,576-token window.
`muse-spark-1.2`	Text, images, PDF; 1,048,576-token window.

OpenClaw itself executes the local read, write, edit, and exec tools; the conversation continues by session ID.
The Guard catalog takes text, images, and PDF as input and returns text. How to send a file or an image depends on the client's interface; this guide does not describe attachments.
The profile uses OpenAI Responses (openai-responses). The server prompt is a separate setting of the Muse family: it applies only when the key has the entitlement and the option is on; client setup does not enable it.

If the connection fails

Symptom	What to check
`401 invalid_api_key`	The client received the complete active `gd-…` key; the variable is set in the same process that starts the client.
`404 model_not_found`	The model ID is an exact ID from the table above or the short name `muse`; other spellings are unsupported.
`404` or incorrect path	Base URL is `https://api.guardrelay.ai/v1`. The client appends `/responses`; do not add it twice.
`400 invalid_request`	The documented API format is selected; extra settings from an older profile were not copied: reasoning, temperature, MCP, and others.
`402 insufficient_credit`	Check available balance and unfinished reservations in your Guard account.
`config validate` fails	Merge fields into existing objects, check JSON5 commas, and use provider name `guard-muse`.
The model is not found	`openclaw models list` must show the full name `guard-muse/muse-wonder-1.0`; select that entry.

Install OpenClaw

Install OpenClaw using its official instructions. The commands below skip channel onboarding, which is unnecessary for a first local chat. Use the first on macOS, Linux, or WSL2; use the second in Windows PowerShell. Check openclaw --version.

bash

curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard
openclaw --version

powershell

& ([scriptblock]::Create((iwr -useb https://openclaw.ai/install.ps1))) -NoOnboard
openclaw --version

Get a Guard key

Open @guardapi → Categories → API, choose a package, and save the gd-… key. OpenClaw needs a separate models.providers.guard entry, but not a different kind of key.

Add a provider to the config

Open ~/.openclaw/openclaw.json (on Windows, the openclaw.json file inside .openclaw in your home folder). If it does not exist, create the folder and file.
Add GUARD_API_KEY=gd-your-key to ~/.openclaw/.env; update an existing line rather than duplicating it. The ${GUARD_API_KEY} substitution in JSON5 reads this variable when OpenClaw starts.
Inside models, set mode: "merge" and add providers.guard. Merge only the new fields and keep channels, agents, tools, and other models.
Use api: "openai-responses" and Base URL https://api.guardrelay.ai/codex/v1. This profile was verified with native Responses.

dotenv

# ~/.openclaw/.env
GUARD_API_KEY=gd-your-key

json5

{
  models: {
    mode: "merge",
    providers: {
      guard: {
        baseUrl: "https://api.guardrelay.ai/codex/v1",
        apiKey: {source: "env", provider: "default", id: "GUARD_API_KEY"},
        api: "openai-responses",
        models: [{
          id: "gpt-6-astra", name: "GPT-6 Astra", reasoning: true,
          input: ["text", "image"],
          cost: {input: 10, output: 50, cacheRead: 1, cacheWrite: 12.5},
          contextWindow: 872000, contextTokens: 272000,
        }],
      },
    },
  },
  agents: {defaults: {model: {primary: "guard/gpt-6-astra"}}},
}

contextWindow: 872000 is the published maximum-window metadata in Guard's catalog for the conversation budget; it does not guarantee that every request of that size will pass. The verified profile uses Responses: maxTokens may stay unset, and Guard accepts and preserves an emitted max_output_tokens without guaranteeing hard managed Codex truncation.

The latest saved Guard native catalog declares these maximum-window values for client-side budgeting. They are not verified hard input caps; the client may compact history sooner. In the Guard connection, all seven models accept and preserve max_output_tokens (Responses), max_completion_tokens (Chat), and max_tokens (Messages) as advisory, without guaranteeing a hard managed Codex output limit; billing follows actual tokens and the key's money rules.

Model ID	Context value for client setup
`gpt-6-astra`	`872000`
`gpt-6.1-sol`	`872000`
`gpt-6-sol`	`872000`
`gpt-6-luna`	`872000`
`gpt-5.6-sol`	`872000`
`gpt-5.6-terra`	`872000`
`gpt-5.6-luna`	`872000`

Validate and start chatting

Run openclaw config validate. If it reports an error, check braces, commas, and that you did not create two separate models objects.
Run openclaw models list and find guard/gpt-6-astra.
For an isolated run, use openclaw agent --local --session-id guard-codex-demo --model guard/gpt-6-astra --thinking medium --message "Reply with exactly OK"; no channels or Gateway daemon are started.
For a follow-up, repeat agent --local with the same --session-id and a new --message; a different id creates another session.

bash

openclaw config validate
openclaw models list
openclaw agent --local --session-id guard-codex-demo --model guard/gpt-6-astra --thinking medium --message "Reply with exactly OK"

If connection fails

Symptom	Check
Config validation fails	Merge fields into existing `models`/`providers` objects; the file is JSON5, so nesting and commas matter.
`401`	The OpenClaw process sees `GUARD_API_KEY`; `.env` has no duplicate value for that name.
Model not found	`guard` is under `models.providers`, its `models` array contains `gpt-6-astra`, and primary is `guard/gpt-6-astra`.
`404` or protocol error	Base URL ends exactly in `/codex/v1`; `api` is `openai-responses`, not `anthropic-messages`.
`402`	Check the key balance and limits in your Guard account.

OpenClaw

Claude, Kimi, Composer and Grok

GLM 5.3 in OpenClaw

Install OpenClaw

Get a Guard key

Add the provider and model

Check and continue

Models and confirmed capabilities

If the connection fails

Gemini in OpenClaw

Install OpenClaw

Get a Guard key

Add the provider and model

Check and continue

Gemini models and capabilities

If the connection fails

Muse in OpenClaw

Install OpenClaw

Get a Guard key

Add the provider and model

Check and continue

Muse models and capabilities

If the connection fails

Install OpenClaw

Get a Guard key

Add a provider to the config

Validate and start chatting

If connection fails

Sections

On this page