Strake sits between OpenClaw and your AI providers. Your real keys stay in an encrypted vault. OpenClaw gets a disposable URL that works exactly the same — and you can revoke it anytime.
Your gateway config. A Discord channel skill. A cron job. A test script. That second instance on a Raspberry Pi. Every copy is a leak surface. And if you need to revoke that key, every single one breaks at the same time.
Your Anthropic, OpenAI, or any provider key goes into an encrypted vault. It never touches the machines running your agents.
Same API calls, same responses. OpenClaw never knows the difference — it's a one-field change in your config file.
Each instance gets its own Strake token. Revoke independently — your real API key is never touched, and everything else keeps running.
The official @strakelabs/openclaw-strake plugin registers Strake as a native model provider inside OpenClaw. Install it once, then use any upstream model via a disposable Strake token.
One command pulls it from the OpenClaw plugin registry — no npm install needed.
Create an endpoint at app.strake.sh, then export the URL and bearer token.
strake/ prefixStrake passes the model ID through unchanged — every model your upstream provider supports works.
strake run for ephemeral tokensThe Strake CLI mints a short-lived token, injects the env vars, launches OpenClaw, then revokes the token when the session ends. Nothing lingers.
Running on a Mac Mini, a Raspberry Pi, and a cloud VPS? Each gets its own Strake token. Revoke one without touching the others.
Share your OpenClaw setup without sharing your real credentials. Recipients use their own Strake endpoints for their own keys.
Something feels off? Revoke the token instantly. Your real API key stays untouched — no provider dashboard needed.
Your real API keys stay in the vault. OpenClaw gets a disposable URL. Leaked token? Revoke in seconds.