A self-hosted agent is useless until it can reach a model. Both Hermes and OpenClaw let you pick an inference provider interactively and store it in a local config file — with secrets in environment variables, never in the file. This guide covers the official commands and config structure (verified 2026-07-31); no live keys are shown.

Hermes — hermes model

Hermes ships an interactive provider picker:

1

hermes model

It lists providers, fetches each one’s live /v1/models list, and lets you choose a default. For the Nous-hosted provider it can do an OAuth login (--no-browser / --manual-paste for headless machines). Re-fetch provider lists with hermes model --refresh.

The result lands in ~/.hermes/config.yaml, structured (key names only) as:

1
2
3
4
5
6
7
8

model:               # default
  provider: <name>
  api_mode: <mode>
providers:           # named providers
  <name>:
    base_url: <https://...>
    api_mode: <mode>
    models: [...]

This is the OpenAI-compatible shape (base_url + api_mode + models), so any OpenAI-compatible endpoint — including a self-hosted proxy like CPA or NewAPI — works as a provider: set base_url to the proxy and put the key in the environment.

OpenClaw — openclaw configure

OpenClaw’s interactive setup covers credentials, channels, gateway, agent, and model in one pass:

1

openclaw configure

For non-interactive edits, OpenClaw exposes typed config helpers:

1
2
3
4
5

openclaw config file                    # print the active config path
openclaw config schema                  # print the JSON schema for openclaw.json
openclaw config get providers.models    # get a value by dot path
openclaw config set <path> <value>      # set by path (value mode, or ref/provider)
openclaw config patch --file ./patch.json5   # one validated JSON5 write

Config lives at ~/.openclaw/openclaw.json; secrets go in ~/.openclaw/.env and are referenced from the config. The managed env keys (e.g. NEWAPI_KEY, CPAMC_KEY) are the ones OpenClaw reads from the environment — so a self-hosted NewAPI or CPA proxy is wired by pointing the provider’s base URL at the proxy and setting the matching *_KEY env var.

Wiring a self-hosted proxy (CPA / NewAPI)

Both harnesses speak OpenAI-compatible providers, so a self-hosted proxy that presents an OpenAI-style /v1/chat/completions works on either:

1. Run the proxy (e.g. CPA on :8317, NewAPI on its port).
2. In the harness config, add a provider whose base_url is the proxy URL.
3. Put the proxy’s API key in the env var the harness reads (Hermes: the config’s key field; OpenClaw: the matching *_KEY env var referenced from openclaw.json).
4. Select it as the default model (hermes model / openclaw configure).

The win: one local proxy fronting many upstream models/keys, with the harness pointing at it — swap upstreams without touching the harness config.

Sources + freshness

Commands (hermes model --help, openclaw configure --help, openclaw config --help) and config structure (Hermes config.yaml key names, OpenClaw config subcommands) verified 2026-07-31. No live credentials were read or shown. Both projects move fast — re-check the CLI before deploying.