Platform LLM Keys

CrabGlamp provides managed OpenAI API keys so you can use AI tools without your own OpenAI account. Keys are billed at 1.5x OpenAI’s cost and charged to your account’s Stripe subscription alongside compute.

---

Available models

Model	Badge	Description
GPT-5.4	Recommended	Best balance of speed, quality, and cost
GPT-5.4 Pro	Premium	Maximum capability for complex tasks
GPT-4o	Budget-friendly	Lower cost, still very capable

Anthropic model support is planned.

---

Creating a key

From the dashboard: Go to LLM Keys and click Create Key.

From the terminal:

crabglamp keys create

Both methods create a key on your account via the OpenAI Admin API. One project is created per account — all keys share it.

---

Assigning keys to agents

A key can be assigned to multiple agents. When assigned, the key is injected into:

• ~/.openclaw/openclaw.json — OpenClaw configuration
• ~/.openclaw/.env — environment variable for other tools

Assign from the dashboard or terminal:

crabglamp keys status    # Check what's assigned to this agent
crabglamp keys refresh   # Re-inject the current key (useful after rotation)

---

Key rotation

Rotate a key when you suspect it’s been exposed or as routine security practice.

crabglamp keys rotate <name>

This creates a new credential, revokes the old one, and bumps the version number. After rotating, run crabglamp keys refresh on each agent that uses the key to inject the new credential.

---

Usage tracking

Platform key usage is polled from OpenAI and synced to your Stripe billing automatically. Usage is tracked per-model with token-level granularity and billed in cents with the 1.5x markup applied.

View usage in the dashboard under Billing.

---

Bring your own key

Platform keys are optional. You can always configure OpenClaw (or any other tool) with your own API keys by editing ~/.openclaw/openclaw.json directly. You won’t be billed through CrabGlamp for your own keys.

---

Security

• Keys are encrypted at rest in CrabGlamp’s database (AES-256-GCM).
• Keys are injected into your agent’s filesystem when assigned.
• The dashboard and CLI use the same API endpoints — dashboard authenticates via Clerk, CLI via HMAC tokens.