Migrate from Self-Hosted OpenClaw

This is a companion to the full OpenClaw migration guide which covers the detailed step-by-step process. This page summarizes the key environment variable changes and the governance benefits you gain.

If you’re running OpenClaw self-hosted, you point OpenClaw’s LLM calls at the Curate-Me gateway instead of directly at the provider. Your OpenClaw container config, skills, and agent definitions stay completely unchanged.

The one-line change


# Before: OpenClaw calls OpenAI directly
OPENAI_BASE_URL=https://api.openai.com/v1
 
# After: OpenClaw calls the CM gateway, which adds governance
OPENAI_BASE_URL=https://api.curate-me.ai/v1/openai
OPENAI_API_KEY=cm_sk_your_gateway_key

That’s the entire migration. OpenClaw’s config, skills, memory, and tools are unchanged.

Environment variable mapping

OpenClaw / LLM env var	Curate-Me equivalent	Notes
`OPENAI_BASE_URL=https://api.openai.com/v1`	`https://api.curate-me.ai/v1/openai`	Required change
`OPENAI_API_KEY=sk-...`	`cm_sk_your_gateway_key`	Your OpenAI key moves to CM Secrets
`ANTHROPIC_API_KEY=sk-ant-...`	Store in CM Secrets; set key to `cm_sk_...`	Same pattern
`GEMINI_API_KEY=...`	Store in CM Secrets; `GOOGLE_BASE_URL=https://api.curate-me.ai/v1/google`	Same pattern

What you gain

Running OpenClaw through the CM gateway gives you:

Feature	Before (direct)	After (via CM)
Cost tracking	Provider dashboard only	Per-session, per-skill, per-agent in CM dashboard
Budget cap	None	Hard daily limit — gateway returns 402 when hit
PII scanning	None	33 patterns scan every prompt before it reaches the provider
Content safety	None	Prompt injection + jailbreak detection
Rate limiting	None	Per-key RPM limits with `RateLimit-*` headers
Audit trail	None	Tamper-proof, full request/response log
HITL gate	None	Flag high-cost agent runs for human review

Store your provider secrets

Once you move the base URL, your OpenAI/Anthropic keys need to live in CM:


curl -X POST https://api.curate-me.ai/v1/admin/secrets \
  -H "X-CM-API-Key: cm_sk_your_gateway_key" \
  -H "Content-Type: application/json" \
  -d '{"provider": "openai", "secret": "sk-your-openai-key"}'

Using Curate-Me Managed Runners instead

If you want to move beyond self-hosting entirely, Curate-Me Managed Runners run OpenClaw in isolated containers with full lifecycle management, desktop streaming, and per-session cost tracking. No infra to maintain.

See the OpenClaw quickstart to start a managed runner in under 5 minutes.

Rollback


export OPENAI_BASE_URL=https://api.openai.com/v1
export OPENAI_API_KEY=sk-your-real-openai-key

OpenClaw’s config is unchanged; it immediately routes directly to OpenAI again.