Sharing OpenAPI Proxy LLM Across Multiple OpenClaw Gateways

Sharing OpenAPI Proxy LLM Across Multiple OpenClaw Gateways

Introduction

Running OpenClaw on multiple machines doesn’t mean you need separate LLM subscriptions for each one. By sharing a single OpenAPI proxy between your VPS and local MacBook, you can centralize your AI model access while maintaining the flexibility of distributed gateways. This setup not only saves costs but also simplifies management and provides consistent model behavior across all your environments.

In this guide, we’ll walk through configuring two OpenClaw gateways—one on a remote VPS and one on your local MacBook—to share the same OpenAPI proxy for LLM access. Whether you’re developing locally and deploying remotely, or simply want to optimize your infrastructure, this approach gives you the best of both worlds.

Why Share an OpenAPI Proxy?

Cost Efficiency: Instead of paying for multiple API subscriptions or running separate model instances, you consolidate everything into a single proxy. This is especially valuable when using paid LLM services or when you have rate limits to manage.

Consistent Behavior: Both gateways access the same models with identical configurations. This means your local development environment matches your production environment exactly—no surprises when you deploy.

Simplified Management: One set of API keys, one configuration to maintain, and one place to monitor usage and costs. Updates and changes propagate automatically to all connected gateways.

Load Balancing: Some OpenAPI proxies support load balancing across multiple model providers or instances, giving you better performance and reliability without additional complexity on each gateway.

Architecture Overview

The setup consists of three main components:

• **OpenAPI Proxy Server:** A centralized service that handles LLM API requests. This can be a self-hosted solution like OneAPI or a cloud-based proxy service.

• **VPS OpenClaw Gateway:** Your remote production or development environment running OpenClaw, configured to use the shared proxy.

• **Local MacBook OpenClaw Gateway:** Your local development environment, also configured to use the same proxy.

Both OpenClaw gateways make requests to the same OpenAPI proxy endpoint, which then forwards them to the underlying LLM providers. The proxy handles authentication, rate limiting, and any additional processing you need.

Setting Up the OpenAPI Proxy

Option 1: Self-Hosted OneAPI

OneAPI is a popular open-source solution for managing multiple LLM providers through a single interface. Here’s how to set it up:

# Clone the repository
git clone https://github.com/songquanpeng/one-api.git
cd one-api

# Configure your providers (edit data/config.json)
# Add your API keys for OpenAI, Anthropic, etc.

# Start the server
docker-compose up -d

OneAPI provides a web interface for managing your API keys, monitoring usage, and configuring routing rules. It supports multiple providers including OpenAI, Anthropic, Google, and various Chinese LLM services.

Option 2: Cloud-Based Proxy Services

If you prefer a managed solution, services like OpenRouter, Together AI, or custom API gateways can serve as your proxy. These services typically offer:

• Unified API endpoints
• Built-in load balancing
• Usage analytics
• Automatic failover

Choose the option that best fits your needs and technical comfort level.

Configuring OpenClaw Gateways

VPS Gateway Configuration

On your VPS, edit the OpenClaw configuration file:

# /root/.openclaw/config.yaml
llm:
  provider: openapi
  openapi:
    baseUrl: "https://your-proxy.example.com/v1"
    apiKey: "your-proxy-api-key"
    model: "gpt-4"  # or your preferred model
    timeout: 30000

Restart the gateway to apply changes:

openclaw gateway restart

Local MacBook Gateway Configuration

On your local machine, use the same configuration:

# ~/.openclaw/config.yaml
llm:
  provider: openapi
  openapi:
    baseUrl: "https://your-proxy.example.com/v1"
    apiKey: "your-proxy-api-key"
    model: "gpt-4"
    timeout: 30000

Restart your local gateway:

openclaw gateway restart

Important: Both gateways should use the same baseUrl and apiKey to ensure they’re accessing the same proxy instance.

Testing the Setup

Verify that both gateways can successfully access the LLM through the shared proxy:

# On VPS
openclaw status

# On local MacBook
openclaw status

Both should show successful connections to the OpenAPI proxy. You can also test by sending a simple message through each gateway and confirming responses are received.

Advanced Configuration

Model Routing

Configure your OpenAPI proxy to route different requests to different models based on criteria like:

• Request complexity
• User or session ID
• Time of day
• Cost thresholds

This allows you to optimize costs by using cheaper models for simple tasks and premium models for complex ones.

Rate Limiting

Implement rate limiting at the proxy level to prevent abuse and manage costs effectively:

# OneAPI example configuration
rate_limits:
  per_minute: 100
  per_hour: 1000
  per_day: 10000

Monitoring and Logging

Set up monitoring to track usage across both gateways:

• Request volume per gateway
• Response times
• Error rates
• Cost tracking

Most OpenAPI proxies provide built-in dashboards or can integrate with monitoring tools like Prometheus and Grafana.

Security Considerations

API Key Management: Store your proxy API keys securely. Use environment variables or secret management tools rather than hardcoding them in configuration files.

Network Security: If your proxy is self-hosted, ensure it’s behind a firewall and uses HTTPS. Consider using a VPN or Tailscale for private network access.

Access Control: Implement authentication at the proxy level to prevent unauthorized access. Each gateway should have its own credentials if possible.

Audit Logging: Enable logging on the proxy to track which gateway is making which requests. This helps with debugging and security auditing.

Troubleshooting

Gateway Can’t Connect to Proxy:

• Verify the proxy URL is correct and accessible
• Check firewall rules on both the proxy and gateway
• Ensure the API key is valid and has sufficient permissions

Inconsistent Behavior Between Gateways:

• Confirm both gateways are using identical configuration
• Check for cached responses or local configuration overrides
• Verify the proxy isn’t applying different rules based on source IP

Rate Limiting Issues:

• Review your proxy’s rate limit settings
• Consider implementing request queuing or retry logic
• Monitor usage patterns to identify bottlenecks

Conclusion

Sharing an OpenAPI proxy between multiple OpenClaw gateways is a powerful pattern for distributed AI infrastructure. It reduces costs, simplifies management, and ensures consistent behavior across all your environments.

Whether you’re running a production VPS and a local development machine, or managing multiple deployment environments, this approach gives you the flexibility you need without the complexity of managing separate LLM setups.

Start with a basic configuration, test thoroughly, and then expand with advanced features like model routing and monitoring as your needs grow. Your future self will thank you for the streamlined, cost-effective setup.

Real-World Use Cases

Local Development with Remote Production

Develop locally on your MacBook using the same models and configurations as your VPS deployment. No more “works on my machine” surprises when pushing to production. The shared proxy ensures identical model behavior, prompts, and responses across both environments.

Multi-User Environments

In a team setting, multiple developers can work on different OpenClaw instances (local laptops, staging servers, production VPS) all sharing the same paid API subscriptions. This dramatically reduces costs when team members need access to the same premium models.

A/B Testing and Model Switching

Use the proxy’s routing capabilities to send some requests to different models based on custom headers. This is perfect for A/B testing model performance or gradually migrating from one provider to another without changing gateway configurations.

Cost Optimization Strategies

As LLM usage grows, costs can spiral. A shared proxy enables sophisticated cost optimization:

Dynamic Model Selection: Configure your proxy to automatically route requests to the most cost-effective model that meets the quality requirements. For example:

• Simple tasks: Use Claude Haiku or GPT-4o-mini
• Medium complexity: Claude Sonnet or GPT-4o
• Complex reasoning: GPT-4 or Claude Opus

Usage Quotas: Set per-gateway quotas to prevent runaway costs from experimental scripts or misconfigured agents.

Caching Layer: Implement response caching at the proxy level for repeated queries, reducing API calls and costs while improving response times.

Failover and Reliability

If your primary LLM provider experiences downtime, the proxy can automatically failover to backup providers. Configure multiple providers in your OpenAPI proxy and set fallback rules. This ensures your OpenClaw gateways remain operational even during provider outages.

Step-by-Step Example: Complete Setup with OneAPI

Let’s walk through a concrete example using OneAPI on a VPS with OpenClaw gateways.

Prerequisites

• A VPS with Docker installed (Ubuntu 22.04 or similar)
• A local MacBook with OpenClaw installed
• API keys for at least one LLM provider (OpenAI, Anthropic, etc.)

Step 1: Install and Configure OneAPI on VPS

SSH into your VPS and run:

# Clone OneAPI
sudo apt-get update && sudo apt-get install -y git docker.io docker-compose
git clone https://github.com/songquanpeng/one-api.git /opt/one-api
cd /opt/one-api

# Create data directory
mkdir -p data

# Edit configuration (you'll add your API keys here)
nano data/config.json

A minimal config.json for OpenAI:

{
  "version": "1.0.0",
  "extra": {
    "admin_emails": [
      "your-email@example.com"
    ]
  },
  "server": {
    "port": 3000,
    "host": "0.0.0.0"
  },
  "log": {
    "level": "info"
  },
  "database": {
    "provider": "sqlite",
    "name": "one-api"
  },
  "channel": "web",
  "channel_web": {
    "enable": true,
    "channel_host": "http://127.0.0.1:3000",
    "channel_web_token": "change-this-to-a-random-string"
  },
  "providers": [
    {
      "label": "OpenAI",
      "name": "openai",
      "type": "openai",
      "base_url": "https://api.openai.com/v1",
      "api_key": "sk-your-openai-api-key-here"
    }
  ],
  "models": [
    {
      "label": "GPT-4",
      "name": "gpt-4",
      "provider": "openai"
    },
    {
      "label": "GPT-4o",
      "name": "gpt-4o",
      "provider": "openai"
    },
    {
      "label": "GPT-4o-mini",
      "name": "gpt-4o-mini",
      "provider": "openai"
    }
  ]
}

Start OneAPI:

docker-compose up -d

The OneAPI admin panel will be available at http://your-vps-ip:3000. Log in with the admin email you set.

Step 2: Create API Token for OpenClaw

In the OneAPI admin panel:

• Go to “Management” → “Token”
• Click “Add Token”
• Name it “OpenClaw Gateway”
• Set unlimited usage (or set quotas based on your needs)
• Copy the generated token (it’s your `apiKey`)

Step 3: Configure VPS OpenClaw

On your VPS, edit /root/.openclaw/config.yaml:

llm:
  provider: openapi
  openapi:
    baseUrl: "http://localhost:3000/v1"
    apiKey: "the-token-you-just-copied"
    model: "gpt-4o"
    timeout: 30000

Restart OpenClaw:

openclaw gateway restart

Test it:

openclaw chat-test "Hello, this is a test from VPS"

Step 4: Configure Local MacBook OpenClaw

On your MacBook, edit ~/.openclaw/config.yaml:

llm:
  provider: openapi
  openapi:
    baseUrl: "http://your-vps-ip:3000/v1"
    apiKey: "the-same-token"
    model: "gpt-4o"
    timeout: 30000

Note: Use the VPS’s public IP or domain. If your VPS is behind a firewall, open port 3000 only to your IP or use Tailscale for a private network.

Restart your local gateway:

openclaw gateway restart

Test locally:

openclaw chat-test "Hello from MacBook"

Both gateways should now use the same underlying LLM via OneAPI.

Step 5: Secure the OneAPI Endpoint

You probably don’t want your OneAPI instance exposed to the entire internet. Secure it:

Option A – Firewall Restriction:

# On VPS, allow only your MacBook's IP
sudo ufw allow from your-macbook-ip to any port 3000
sudo ufw deny 3000

Option B – Use Nginx Reverse Proxy with HTTPS:

server {
    listen 443 ssl http2;
    server_name your-domain.com;

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    location /v1 {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Then configure OpenClaw to use https://your-domain.com/v1.

Option C – Tailscale VPN:

Install Tailscale on both VPS and MacBook. Use the Tailscale IP as the baseUrl. This is the simplest and most secure, as traffic stays within the private mesh network.

Performance Considerations

Latency

The shared proxy adds an extra hop, which introduces some latency. Expect:

• Local proxy (same machine): ~50-100ms overhead
• VPS proxy across internet: ~200-500ms additional latency

For real-time applications, you might want:

• A local model for low-latency tasks
• Remote proxy for complex reasoning tasks where speed matters less

Connection Pooling

OpenClaw and your OpenAPI proxy both benefit from connection pooling. Configure appropriate timeouts and keep-alive settings to avoid creating new connections for every request.

In OpenClaw config:

openapi:
  keepAlive: true
  maxConnections: 10

In OneAPI (or your proxy), tune the underlying HTTP client settings similarly.

Concurrent Requests

Both OpenClaw and the proxy handle multiple concurrent requests. Ensure your VPS has sufficient resources (CPU, memory, and notably network bandwidth) to handle the combined load from all gateways.

Monitor with htop or docker stats and scale up if needed.

Management and Monitoring

Track Gateway Usage

Your proxy should log which gateway made each request. In OneAPI, you can add custom headers to distinguish sources:

# In OpenClaw config (add custom header):
openapi:
  headers:
    X-Gateway-Id: "vps-gateway"  # or "macbook-local"

Then in OneAPI’s token request logs, you’ll see which gateway made which calls.

Set Up Alerts

Configure alerts for:

• Unusual spikes in usage (potential issues or abuse)
• Failed API calls exceeding threshold
• Proxy service downtime

Most proxies can send webhooks on events, which you can connect to Slack, email, or OpenClaw itself.

Periodic Token Rotation

For security, rotate the shared API token periodically. Create a new token, update all gateways, then revoke the old one. This limits exposure if a token is compromised.

Software-Specific Tips for OpenClaw

Auto-reconnect on Proxy Downtime

If the proxy goes down, OpenClaw should attempt to reconnect. The default behavior usually includes exponential backoff, but you can tune:

llm:
  openapi:
    retryAttempts: 3
    retryDelayMs: 1000

Model Fallback

Configure OpenClaw to try alternative models if the primary one fails:

llm:
  openapi:
    model: "gpt-4"
    fallbackModels:
      - "gpt-4o"
      - "claude-3-opus"

This requires your proxy to support multiple providers and models.

Session Persistence

OpenClaw’s session functionality (chat history, context) is stored locally on each gateway. Sharing a proxy doesn’t affect this—all conversation data remains on each machine. If you want to sync sessions between gateways, you’d need additional infrastructure (a shared database or message bus), but that’s beyond the scope of proxy sharing.

Common Pitfalls and How to Avoid Them

Pitfall 1: Different Model Names

OpenClaw configurations on different gateways might specify different model names. Double-check that both configs use the exact same model name string that the proxy expects.

Fix: Copy the model name from your proxy’s model list (in OneAPI admin panel) exactly.

Pitfall 2: Proxy CORS Issues

If you’re using a web-based OpenClaw frontend that talks directly to the proxy, CORS can block requests. The proxy should be configured to allow your frontend’s origin.

Fix: In OneAPI, set CORS origins in config or use Nginx to add CORS headers.

Pitfall 3: Timezone Differences

Logging and usage metrics might be off if your VPS and MacBook have different timezones. Use UTC everywhere or ensure consistent timezone settings.

Fix: Set TZ=UTC on all machines or explicitly configure timezone in your proxy and gateway configs.

Pitfall 4: Silent Failures

If the proxy is unreachable, OpenClaw might fail silently or produce default responses. Always check logs when things behave oddly.

Fix: Monitor OpenClaw and proxy logs with tools like journalctl, docker logs, or centralized logging. Set up alerts for repeated errors.

Extending the Pattern to More Gateways

This architecture scales. You can add more OpenClaw gateways (another VPS, a Raspberry Pi, a CI/CD runner) and have them all share the same proxy. Just:

• Install OpenClaw on the new machine
• Copy the same `baseUrl` and `apiKey` config
• Ensure network access to the proxy
• Optionally add unique `X-Gateway-Id` headers

The proxy becomes your central AI infrastructure hub.

Conclusion

Sharing an OpenAPI proxy between multiple OpenClaw gateways transforms your AI infrastructure from scattered, duplicated setups into a unified, manageable system. It’s a pattern that delivers immediate cost savings, better consistency, and simplified operations.

The steps are straightforward: set up a proxy (OneAPI or managed service), configure each OpenClaw gateway to point to it, and secure the connection. From there, you can build out advanced features like routing, monitoring, and failover as your needs grow.

This approach exemplifies the Unix philosophy: create one tool that does one thing well (the proxy handles LLM access), then compose it with other tools (OpenClaw gateways) to build powerful, flexible systems. It’s how expert developers build production AI infrastructure—modular, maintainable, and cost-effective.

Start with the basic setup today, and iterate toward a more sophisticated configuration as your usage grows. The benefits compound over time.

—

Appendix: Sample Configurations

Complete OpenClaw config.yaml for Shared Proxy

# ~/.openclaw/config.yaml
gateway:
  name: "my-openclaw-gateway"
  nodeId: "optional-unique-id"

llm:
  provider: openapi
  openapi:
    baseUrl: "https://ai-proxy.example.com/v1"
    apiKey: "${OPENCLAW_SHARED_API_KEY}"  # Use env var for security
    model: "gpt-4o"
    timeout: 30000
    keepAlive: true
    maxConnections: 10
    retryAttempts: 3
    retryDelayMs: 1000
    headers:
      X-Gateway-Id: "macbook-local"
      X-User: "robin"
    stream: true
    temperature: 0.7
    maxTokens: 4096

# Optional: Override model per agent
agents:
  japanese-teacher:
    llm:
      model: "claude-3-sonnet"
  content-writer:
    llm:
      model: "gpt-4o"

# Logging
logging:
  level: "info"
  file: "/var/log/openclaw/gateway.log"

OneAPI Minimal config.json

{
  "version": "1.0.0",
  "server": {
    "port": 3000,
    "host": "0.0.0.0"
  },
  "log": {
    "level": "info"
  },
  "database": {
    "provider": "sqlite",
    "name": "one-api"
  },
  "providers": [
    {
      "label": "OpenAI",
      "name": "openai",
      "type": "openai",
      "base_url": "https://api.openai.com/v1",
      "api_key": "sk-..."
    }
  ],
  "models": [
    {
      "label": "GPT-4o",
      "name": "gpt-4o",
      "provider": "openai",
      "max_context": 128000
    },
    {
      "label": "GPT-4o-mini",
      "name": "gpt-4o-mini",
      "provider": "openai",
      "max_context": 128000
    }
  ]
}

Nginx Reverse Proxy Snippet (HTTPS)

upstream oneapi_backend {
    server 127.0.0.1:3000;
    keepalive 32;
}

server {
    listen 443 ssl http2;
    server_name ai.example.com;

    ssl_certificate /etc/letsencrypt/live/ai.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ai.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    location /v1 {
        proxy_pass http://oneapi_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # Rate limiting
    limit_req_zone $binary_remote_addr zone=oneapi:10m rate=10r/s;
    limit_req zone=oneapi burst=20;
}

With this configuration, your OpenClaw gateways will communicate securely and efficiently through the shared proxy, while Nginx handles HTTPS termination, connection pooling, and basic rate limiting.

—

Resources

• **OneAPI GitHub:** https://github.com/songquanpeng/one-api
• **OpenAPI Specification:** https://github.com/OAI/OpenAPI-Specification
• **OpenClaw Documentation:** https://docs.openclaw.ai
• **OpenRouter:** https://openrouter.ai (alternative managed proxy)
• **Tailscale:** https://tailscale.com (for secure private networking)

By adopting this shared proxy architecture, you’re not just solving the immediate problem of multiple gateways needing LLM access—you’re building a foundation for a scalable, cost-effective AI infrastructure that can grow with your needs.