LLM Provider

Intern's reasoning runs on a Claude model. You supply the API key, base URL, and model name during pairing; everything else (tool routing, system prompts, channel formatting) is handled by OpenClaw.

What the wizard asks for

All three fields are required by SetupRequest validation (lib/openclaw/domain/setup.go):

Field	Config key	Notes
Base URL	llm_base_url	Anthropic API URL, or a proxy that mirrors it
API key	llm_api_key	Bearer token for <base>/v1/messages, <base>/ping, <base>/supermemory/allocate
Model	llm_model	Claude model name. The intern-server default (when not set) is claude-opus-4-6 (app/intern/server/config/config.go)

All three are persisted to /root/config/config.json:

{
  "llm_base_url": "https://api.anthropic.com",
  "llm_api_key":  "sk-ant-...",
  "llm_model":    "claude-opus-4-6"
}

What the key is used for

The same llm_api_key is used as a Bearer token by three distinct call paths:

1. OpenClaw → <llm_base_url>/v1/messages for every chat turn (this is what actually answers your messages).
2. intern-server → <llm_base_url>/ping — the device's heartbeat (Ping in app/intern/internal/beclient/client.go).
3. intern-server → <llm_base_url>/supermemory/allocate — the per-device Supermemory key allocation.

So the URL you point llm_base_url at must accept the key on all three paths (or proxy the latter two to whatever backend handles device fleet operations).

Using a custom gateway

If your org runs a proxy in front of Anthropic (rate limiting, audit, cost accounting), point llm_base_url at it. The proxy must:

• Accept Bearer-token auth on the same key
• Expose /v1/messages with the Anthropic request/response schema and streaming
• Expose /ping and /supermemory/allocate if you want device-status reporting and Supermemory to work (the device is a no-op for either when the endpoint is missing or returns 404)

Rotating the key

To swap the API key without re-running the full wizard, edit /root/config/config.json and restart both services:

sudo jq '.llm_api_key = "sk-ant-new-key"' /root/config/config.json | sudo tee /root/config/config.json.tmp
sudo mv /root/config/config.json.tmp /root/config/config.json
sudo systemctl restart intern openclaw

The next /ping heartbeat uses the new key, and OpenClaw picks it up on gateway restart.

Verify

After setup, tail OpenClaw and send a quick message on your channel:

journalctl -u openclaw -f

You should see a request to <llm_base_url>/v1/messages and a streaming response.

Troubleshooting

Symptom	Likely cause
401 unauthorized on every reply	llm_api_key is wrong or revoked
403 from gateway	Custom proxy isn't passing the key through, or doesn't recognise the device
404 from /supermemory/allocate	The base URL doesn't expose that path — see Supermemory Overview
429 bursts	Provider rate limit on the account — upgrade your tier
Setup never finishes	Check journalctl -u intern -f and /var/log/intern.log for the actual error