What this page covers: keys, quota, and billing boundaries
If OpeClaw opens fine but cloud model calls fail with 401, 429, “invalid api key,” or “quota exceeded,” the issue is usually credentials and usage—not antivirus or Gatekeeper.
Our connection-troubleshooting guide covers install source, proxies, and ports end to end. This article goes deep on configuring the OpeClaw API key, handling exhausted quota, and separating billing boundaries. App won’t launch? Use the won’t-open guide. Local Ollama/LM Studio setup? Use the local LLM article.
How to configure an OpeClaw API key
Open OpeClaw settings and find Models or Model Providers. Create or edit the cloud provider you need: paste the API key from that vendor’s console, confirm Base URL / region match their docs, save, then send one short test with that model selected.
Copy/paste traps are common: leading/trailing spaces, truncated secrets, using a project ID as a key, or pasting vendor A’s key into vendor B’s slot. When a test fails, reveal the key once in the vendor console and compare before swapping installers.
If you inject secrets via environment variables, confirm the variable names match the current OpeClaw release notes, then restart the app and retest. Keep keys on the machine or in a keychain—never in a public repo or screenshot.
- Create or rotate an API key in the vendor console; confirm it is not revoked.
- Paste it into the matching OpeClaw provider entry and save.
- Verify with a short chat before wiring long workflows.
401: fix the key before blaming quota
401 Unauthorized means “not authorized.” In practice that is most often a revoked or expired key, a mangled paste, missing model permission, or an org/project key bound to the wrong project.
Keep a fixed order: stop auto-retries → verify key status and scopes in the vendor console → rotate if needed and update only the one OpeClaw provider → test once. Hammering the same 401 only muddies logs and can trip abuse controls.
If only one provider returns 401 while others work, treat it as that credential or endpoint—not as “OpeClaw is broken.”
429 and exhausted quota: pause, then check billing
HTTP 429 and messages that mention quota, rate limit, or billing are about usage and throttling, not about reinstalling the client. Pause concurrent agents and batch jobs, then open the vendor usage/billing pages for today’s request counts, remaining quota, and hard RPM/TPM caps.
Free-tier exhaustion, trial expiry, failed payment methods, or a shared org budget drained by teammates can all look like a sudden connection failure. Recovery is wait for reset, upgrade, or temporarily switch models—not antivirus allowlisting.
On the OpeClaw side: lower parallelism, space out retries, and move draft steps to a local model (see the local LLM setup article) so expensive cloud calls stay for final passes.
Billing boundaries: who charges what
Keep three layers separate: whether OpeClaw is installed correctly, whether cloud tokens bill against your provider API key, and whether this site’s download page is only an install entry. Token spend usually lives on the model vendor; a third-party download guide cannot adjust their invoices.
When “connection failed” includes a clear 401/429/quota signal, stay on keys and quota. Timeouts, proxy certificates, EADDRINUSE, or an app that never launches belong on the connection or won’t-open guides—not endless key edits.
The pricing page helps with product-tier differences on this site. Per-token prices follow whatever your chosen vendor publishes today; this article will not invent numbers.
When to leave this page
UI works, only model calls fail with 401/429 → stay here and fix keys or quota.
Base URL points at 127.0.0.1, local server not running, or model name mismatches ollama list → use the local LLM setup article instead of rotating cloud keys.
Unclear install source, corporate proxy, port conflicts, or the app won’t start → use connection troubleshooting, the FAQ, and the download status page. Routing the symptom to the right URL beats stuffing every failure mode onto one keyword.
Key / quota checklist table (no new claims)
This table only restates the splits above. It does not change “401 → key first,” “429 → pause then billing,” or “cloud spend lives on the vendor,” and it does not replace proxy/port steps in the connection guide.
| Symptom | Do this first | Common mistake |
|---|---|---|
| 401 / invalid api key | Verify, rotate key and provider scopes | Treat as quota or reinstall immediately |
| 429 / quota / rate limit | Stop retries; check usage and billing | Retry loops that tighten throttling |
| Only one cloud model fails | Inspect that key and endpoint | Delete every provider and start over |
| Only local model fails | Check local API and model name | Rotate cloud API keys |
| App will not open | Won’t-open guide / download page | Edit keys with no UI |
Console labels vary by vendor; this page does not promise human support SLAs or fixed plan prices.
API Key & Quota FAQ
Where do I enter an OpeClaw API key?
Usually under Settings → Models / Model Providers for the cloud provider you use. Save, then send a short test message. Local Ollama-style endpoints often accept a placeholder key; cloud providers validate the real secret.
Does 401 Unauthorized mean I ran out of quota?
Usually no. 401 points to an invalid, expired, mistyped, or under-permissioned key (or the wrong provider). Quota exhaustion and rate limits more often show up as 429 or explicit quota / billing messages.
What should I do on HTTP 429 or “quota exceeded”?
Stop rapid retries. Check the model provider’s usage, billing, and rate-limit pages. Retry in OpeClaw only after quota recovers or you switch to a plan/model that still has capacity—do not treat throttling as a reason to reinstall.
Does OpeClaw bill me, or does the model vendor?
Cloud inference cost is typically charged on the provider account tied to your API key. OpeClaw is the local workflow entry that calls that key. Use the current pricing page and the provider invoice as sources of truth—this article does not invent plan numbers.
Use this with an OpeClaw workflow
Check the current OpeClaw download status first, then save this guide as part of your setup, review, or troubleshooting workflow.