Skip to main content

Bringing your own AI provider key

Hermes and OpenClaw, the agents in the Services marketplace, run on your own AI provider key. Hostless does not provide or subsidize AI inference for either agent — you bring a key from OpenRouter, OpenAI, or Anthropic, and that provider bills you directly for what the agent uses.

This page covers, for each provider: where to get a key, roughly what it costs, what limits to set on it, where to paste it when you deploy, and exactly how Hostless stores it.

OpenRouter (Hermes)​

  • Get a key: openrouter.ai/keys.
  • Cost: pay-as-you-go, billed by OpenRouter per token at the rate of whichever model you select. Some models are suffixed :free and cost nothing, though they're rate-limited and not guaranteed to stay available.
  • Limits: OpenRouter lets you set a credit limit on the key itself, from your OpenRouter dashboard. Hostless does not cap spend on your behalf — if you want a ceiling, set one there before pasting the key in.
  • Where to paste it: on the "Configure" step of Deploy a service, in the OpenRouter API Key field.

OpenAI (Hermes)​

  • Get a key: platform.openai.com/api-keys.
  • Cost: pay-as-you-go, billed by OpenAI per token at the selected model's rate. No free tier.
  • Limits: set a usage limit on your OpenAI account (Settings → Limits) if you want to cap spend; OpenAI enforces this at the account level, not per-key.
  • Where to paste it: the OpenAI API Key field on the same Configure step.

Anthropic (Hermes and OpenClaw)​

  • Get a key: console.anthropic.com.
  • Cost: pay-as-you-go, billed by Anthropic per token at the selected model's rate. No free tier.
  • Limits: Anthropic Console lets you set a monthly spend limit per API key under the key's settings; set one before pasting it in if you want a cap.
  • Where to paste it: the Anthropic API Key field on the Configure step. For OpenClaw this key is required; the form will not let you deploy without one. For Hermes it's one of three options — you only need one of OpenRouter, OpenAI, or Anthropic.

How Hostless stores your key​

Your key is saved in Hostless's database alongside the rest of your service's configuration. It is not encrypted at the application layer beyond the database's own storage. It is excluded from the general list and detail API responses the dashboard uses to show your services, so it isn't returned as part of ordinary browsing. Unlike Hermes's own generated secrets (its dashboard password and API server key, which you can view again from your service's secrets page), your provider key itself is write-only once saved — no endpoint reads it back, so there's no way to view it again after you've pasted it in. When the service deploys, the key is injected as a plain environment variable into the container that runs your agent, inside Hostless's own cluster; it is never sent anywhere else and never used to authenticate on Hostless's behalf.

If you need to change a key, paste the new value into the same Configure field and redeploy; it overwrites the old value going forward. There is no way to retrieve the previous key first, so keep a copy somewhere safe (like your provider's own dashboard) if you might need it again.

Choosing a model​

The Model field on the Configure step lists both :free OpenRouter models and paid ones. Which models actually work depends on which key you supplied: OpenRouter-routed models (including the :free ones) need an OpenRouter key; picking a model that doesn't match your key will fail at runtime, not at deploy time, so double-check the pairing before you deploy.