A virtual key (cg-pk-…) is a single credential that proxies requests to OpenAI, Anthropic, and ElevenLabs through a central gateway. The proxy holds the provider credentials, enforces a spend cap, and adds usage to your invoice as it accrues.
This tutorial requires a running Agent. If you have not done that, complete Get started with Agents first.
Create the virtual key from the Agent terminal
Open the Agent's code-server tab and open a terminal. Run:
crabglamp keys create
There are no prompts. Each Agent has exactly one virtual key; this command creates it and automatically points the Agent's OpenClaw gateway at the proxy. The key is provider-agnostic — the same cg-pk-… token works for OpenAI, Anthropic, and ElevenLabs, because the proxy routes by URL. To choose or switch the provider and model the key uses, run crabglamp keys configure.
A new key has no spend cap by default. Set one from the dashboard at /dashboard/llm (minimum $20) — see Raise a spend cap. To rotate the token later, run crabglamp keys regenerate.
Use the key from your own code
crabglamp keys create already configured OpenClaw, so agent sessions work out of the box. To call the proxy from your own SDK or script, point the SDK's base URL at the proxy and pass the key as the API key. The key is stored in ~/.openclaw/.env under the provider env var (e.g. OPENAI_API_KEY); export it and the matching base URL:
export OPENAI_API_KEY="cg-pk-..."
export OPENAI_BASE_URL="https://llm.crabglamp.dev/openai/v1"
For Anthropic:
export ANTHROPIC_API_KEY="cg-pk-..."
export ANTHROPIC_BASE_URL="https://llm.crabglamp.dev/anthropic/v1"
Same cg-pk-… token, different base URLs per provider. The Anthropic SDK does not auto-append /v1, so the base URL must include it. The token authenticates against the proxy; the proxy forwards to the provider using the platform's pooled credentials.
Make a verification request
With the OpenAI variables exported, run:
curl -s "$OPENAI_BASE_URL/chat/completions" \
-H "Authorization: Bearer $OPENAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "gpt-4.1-mini",
"messages": [{"role": "user", "content": "Reply with the literal word: pong"}]
}'
The response includes "content": "pong" and usage metadata. The proxy records the cost against your spend cap.
Check usage in the dashboard
Open /dashboard/llm. The key you created appears as a card showing the spend cap, accrued spend (refreshed every couple of minutes), and a per-model breakdown.
If the accrued spend is showing $0.00 immediately after your verification request, that is the reporting cadence — spend appears within a couple of minutes. Refresh and the request cost appears.
What is next
Read the LLM proxy reference for the full list of supported providers, models, and prices. To raise or lower the spend cap, follow Raise a spend cap. To rotate a key, follow Rotate a virtual key. To understand how the cap is enforced, read Spend-cap enforcement.