OpenClaw: Claude, Codex, and DeepSeek configuration

Choose the OpenClaw adapter that matches the CloudService model family instead of mixing different endpoint contracts under one provider.

Keep each transport in its own OpenClaw provider. Claude uses anthropic-messages, Codex uses openai-responses, and deepseek-v4-flash uses openai-completions.

Automatic configuration

bash

npm install -g cloudservice@latest
cloudservice

Select OpenClaw. The CLI reads the authenticated catalog, creates only the matching protocol providers, backs up ~/.openclaw/openclaw.json, installs file-backed SecretRefs, and validates the result. DeepSeek is kept out of the Responses provider automatically. Recheck the setup with cloudservice doctor.

Shared SecretRefs for manual setup

bash

umask 077
mkdir -p "$HOME/.openclaw/secrets"
printf "CloudService API key: "
IFS= read -r -s CLOUDSERVICE_API_KEY
printf "\n"
printf "%s\n" "$CLOUDSERVICE_API_KEY" > "$HOME/.openclaw/secrets/cloudservice-api-key"
unset CLOUDSERVICE_API_KEY
printf "%s\n" "CloudService-OpenClaw/1.0" > "$HOME/.openclaw/secrets/cloudservice-user-agent"
chmod 600 "$HOME/.openclaw/secrets/cloudservice-api-key" "$HOME/.openclaw/secrets/cloudservice-user-agent"

Merge this SecretRef block into ~/.openclaw/openclaw.json once:

json5

secrets: {
  providers: {
    cloudservice_cli: {
      source: "file",
      path: "~/.openclaw/secrets/cloudservice-api-key",
      mode: "singleValue"
    },
    cloudservice_cli_user_agent: {
      source: "file",
      path: "~/.openclaw/secrets/cloudservice-user-agent",
      mode: "singleValue"
    }
  }
}

Manual configuration for Codex models in OpenClaw

Merge this alternative provider into the same JSON5 file. For an OpenAI token-pack key, change only baseUrl to https://api.yourdomain.example/token/v1.

json5

models: {
  mode: "merge",
  providers: {
    "cloudservice-codex": {
      baseUrl: "https://api.yourdomain.example/v1",
      apiKey: { source: "file", provider: "cloudservice_cli", id: "value" },
      api: "openai-responses",
      request: {
        headers: {
          "User-Agent": { source: "file", provider: "cloudservice_cli_user_agent", id: "value" }
        },
        allowPrivateNetwork: false
      },
      models: [
        { id: "codex-auto-review", name: "Codex Auto Review" },
        { id: "gpt-5.3-codex", name: "GPT 5.3 Codex" },
        { id: "gpt-5.4", name: "GPT 5.4" },
        { id: "gpt-5.4-mini", name: "GPT 5.4 Mini" },
        { id: "gpt-5.5", name: "GPT 5.5" },
        { id: "gpt-5.6-luna", name: "GPT 5.6 Luna" },
        { id: "gpt-5.6-sol", name: "GPT 5.6 Sol" },
        { id: "gpt-5.6-terra", name: "GPT 5.6 Terra" }
      ]
    }
  }
},
agents: {
  defaults: {
    model: { primary: "cloudservice-codex/gpt-5.6-terra" },
    utilityModel: "cloudservice-codex/gpt-5.4-mini"
  }
}

The openai-responses adapter is required for Codex tool events. Do not list these models under anthropic-messages.

Manual configuration for DeepSeek V4 Flash in OpenClaw

Merge this as a third provider. For a DeepSeek token-budget key, change only baseUrl to https://api.yourdomain.example/token/v1.

json5

models: {
  mode: "merge",
  providers: {
    "cloudservice-deepseek": {
      baseUrl: "https://api.yourdomain.example/v1",
      apiKey: { source: "file", provider: "cloudservice_cli", id: "value" },
      api: "openai-completions",
      maxTokens: 4096,
      request: {
        headers: {
          "User-Agent": { source: "file", provider: "cloudservice_cli_user_agent", id: "value" }
        },
        allowPrivateNetwork: false
      },
      models: [
        {
          id: "deepseek-v4-flash",
          name: "DeepSeek V4 Flash",
          reasoning: true,
          input: ["text"],
          maxTokens: 4096,
          compat: {
            supportsTools: true,
            supportsToolChoice: false,
            supportsReasoningEffort: true,
            supportsUsageInStreaming: true,
            maxTokensField: "max_tokens",
            requiresReasoningContentOnAssistantMessages: true
          }
        }
      ]
    }
  }
},
agents: {
  defaults: {
    model: { primary: "cloudservice-deepseek/deepseek-v4-flash" },
    utilityModel: "cloudservice-deepseek/deepseek-v4-flash"
  }
}

deepseek-v4-flash is available through CloudService's /v1/chat/completions contract, not /v1/responses. Use the agent flags above only when your authenticated /v1/models entry reports capabilities.tools=true. Thinking-mode tool loops require exact reasoning_content replay and reject tool_choice, which is why both compatibility flags are explicit.

If discovery reports tools=false, set reasoning: false and compat: { supportsTools: false }, or use Continue Chat/Edit. cloudservice update performs this capability selection automatically. Use only the customer's CloudService key; no upstream credential belongs on their device.

Manual configuration for Claude models in OpenClaw

Use this alternative for Claude. For a Claude token-pack key, change only baseUrl to https://api.yourdomain.example/token. The Messages adapter appends /v1/messages, so its base URL must not end in /v1.

json5

models: {
  mode: "merge",
  providers: {
    "cloudservice-claude": {
      baseUrl: "https://api.yourdomain.example",
      apiKey: { source: "file", provider: "cloudservice_cli", id: "value" },
      api: "anthropic-messages",
      maxTokens: 4096,
      request: {
        headers: {
          "User-Agent": { source: "file", provider: "cloudservice_cli_user_agent", id: "value" }
        },
        allowPrivateNetwork: false
      },
      models: [
        { id: "fable-5", name: "Fable 5", contextWindow: 1050000, maxTokens: 4096 },
        { id: "claude-haiku-4-5-20251001", name: "Claude Haiku 4.5", contextWindow: 200000, maxTokens: 4096 },
        { id: "claude-opus-4-6", name: "Claude Opus 4.6", contextWindow: 200000, maxTokens: 4096 },
        { id: "claude-opus-4-7", name: "Claude Opus 4.7", contextWindow: 200000, maxTokens: 4096 },
        { id: "claude-opus-4-8", name: "Claude Opus 4.8", contextWindow: 200000, maxTokens: 4096 },
        { id: "claude-opus-5", name: "Claude Opus 5", contextWindow: 1000000, maxTokens: 128000 },
        { id: "claude-sonnet-5", name: "Claude Sonnet 5", contextWindow: 200000, maxTokens: 4096 }
      ]
    }
  }
},
agents: {
  defaults: {
    model: { primary: "cloudservice-claude/claude-opus-5" },
    utilityModel: "cloudservice-claude/claude-haiku-4-5-20251001"
  }
}

The provider keeps a conservative 4096-token default for older entries. Claude Opus 5's per-model 128000 value overrides that default and reflects its native output limit; lower it if you want a smaller per-response budget.

Verify with the built-in probe

bash

openclaw config validate
openclaw secrets audit --check
openclaw models list
openclaw models status --probe --probe-max-tokens 1 --probe-timeout 60000 --json
openclaw infer model run --model cloudservice-deepseek/deepseek-v4-flash --prompt "Reply with K only." --json
cloudservice update

Run the DeepSeek model command only when that provider is configured. After a text probe passes, ask it to use one harmless read-only tool and confirm the tool result is returned before enabling write or shell tools. OpenClaw 2026.7.1 can materialize resolved SecretRefs in its private generated agent cache during a probe; the final cloudservice update scrubs that generated copy and restores the file-backed source of truth.

Keep the key private

Never paste the real key into openclaw.json, a workspace environment file, or a support transcript. Keep the SecretRef files user-only and leave allowPrivateNetwork disabled for the public CloudService gateway.

See OpenClaw's custom-provider reference.