OpenClaw

Configure OpenClaw to send its requests to FlexInference through a custom provider. Use the OpenClaw CLI, not hand-edited JSON, so every write is schema-validated.

You will never see or handle my API key. OpenClaw will read it from the `FLEXINFERENCE_API_KEY` environment variable through a secret reference, and I export that myself. Do not ask me for the key, do not pass it on any command line, and do not read it from my environment.

Ask whether to use my default OpenClaw profile or a separate one. A separate profile isolates config, state, gateway port, and workspace, and is the safe way to try this. Prefix every command with `--profile flex` if I choose one.

1. Confirm which config file is active with `openclaw config file`.

2. Tell me to export the key first, and stop until I confirm. Print this line; do not run it and do not ask for the value:

export FLEXINFERENCE_API_KEY=<paste your key here>

3. Write the provider entry. It carries no credential. The model row is required, because OpenClaw refuses a third-party provider that declares no `models`; step 5 replaces it with the full catalog:

openclaw config set models.providers.flexinference --merge --strict-json '{"baseUrl":"https://api.flexinference.com/v1","api":"openai-completions","models":[{"id":"gpt-5.6-sol","name":"GPT-5.6 Sol","compat":{"supportsUsageInStreaming":true}}]}'

4. Declare an environment secrets provider, then point the provider's apiKey at it. Both commands pass only the VARIABLE NAME, never the value:

openclaw config set secrets.providers.default \
  --provider-source env --provider-allowlist FLEXINFERENCE_API_KEY

openclaw config set models.providers.flexinference.apiKey \
  --ref-provider default --ref-source env --ref-id FLEXINFERENCE_API_KEY

5. Fill the model list from the live FlexInference catalog rather than by hand:

curl -s https://api.flexinference.com/v1/models \
  -H "Authorization: Bearer $FLEXINFERENCE_API_KEY" \
| jq '{models:{providers:{flexinference:{models:
    [.data[] | {id, name: .id, compat: {supportsUsageInStreaming: true}}]}}}}' \
| openclaw config patch --stdin

Run every write with `--dry-run` first and show me the diff before applying it.

6. Verify with `openclaw models list --provider flexinference`, then run `openclaw security audit`.

Rules that matter, do not deviate:
- Never pass my key as an argument to an `openclaw` command, and never write it into a config file. `openclaw onboard --custom-api-key` does both, which is why step 4 uses a reference instead.
- Step 5 is the one place the key expands, into curl's `-H` argument, where a same-user process can read it. That is a deliberate trade for a single catalog read. Do not extend it to any other command.
- The provider id must be `flexinference` in every command. If an earlier setup derived `custom-api-flexinference-com` from the host, tell me, and use that id consistently instead of creating a second provider.
- `api` must be `openai-completions`. That is the only adapter FlexInference's Chat Completions surface works with here.
- The base URL must end in `/v1`.
- You MUST list models explicitly. OpenClaw only lets its own built-in provider ids omit `models`, and it will never call `GET /v1/models` for a provider defined in config. Model discovery is a plugin capability and does not apply here.
- Every model row needs `compat: { supportsUsageInStreaming: true }`. OpenClaw makes streaming usage opt-in for third-party endpoints, and without it every streamed turn reports zero tokens and no cost.
- Leave `"mode": "merge"` alone so my existing providers survive.
- Step 4 resolves the reference at write time, so it fails if I have not exported the variable yet. That failure is expected, not a reason to fall back to a literal key.
- FlexInference's catalog publishes no context window or token ceiling, so generated rows carry neither. Do not invent values; leave them out unless I give you numbers.

Report what you changed and which config file you wrote.