# OpenClaw: Claude, Codex, and DeepSeek configuration > Choose the OpenClaw adapter that matches the ScaleMax model family instead of mixing different endpoint contracts under one provider. > **Keep each transport in its own OpenClaw provider.** Claude uses `anthropic-messages`, Codex uses `openai-responses`, and `deepseek-v4-flash` uses `openai-completions`. ## Automatic configuration **macOS / Linux** ```bash npm install -g scalemax@latest scalemax ``` **Windows PowerShell** ```powershell npm.cmd install -g scalemax@latest scalemax.cmd ``` Windows PowerShell blocks npm’s .ps1 launchers by default (“running scripts is disabled on this system”), so these commands use the .cmd launcher: npx.cmd, npm.cmd, scalemax.cmd. In Command Prompt you can leave out .cmd. Select **OpenClaw**. The CLI reads the authenticated catalog, creates only the matching protocol providers, backs up `~/.openclaw/openclaw.json`, installs file-backed SecretRefs, and validates the result. DeepSeek is kept out of the Responses provider automatically. Recheck the setup with `scalemax doctor`. ## Shared SecretRefs for manual setup **macOS / Linux** ```bash umask 077 mkdir -p "$HOME/.openclaw/secrets" printf "ScaleMax API key: " IFS= read -r -s SCALEMAX_API_KEY printf "\n" printf "%s\n" "$SCALEMAX_API_KEY" > "$HOME/.openclaw/secrets/scalemax-api-key" unset SCALEMAX_API_KEY chmod 600 "$HOME/.openclaw/secrets/scalemax-api-key" printf "%s\n" "ScaleMax-OpenClaw/1.0" > "$HOME/.openclaw/secrets/scalemax-user-agent" chmod 600 "$HOME/.openclaw/secrets/scalemax-user-agent" ``` **Windows PowerShell** ```powershell New-Item -ItemType Directory -Force -Path "$HOME\.openclaw\secrets" | Out-Null $secret = Read-Host "ScaleMax API key" -AsSecureString [IO.File]::WriteAllText("$HOME\.openclaw\secrets\scalemax-api-key", [System.Net.NetworkCredential]::new("", $secret).Password + "`n") Remove-Variable secret [IO.File]::WriteAllText("$HOME\.openclaw\secrets\scalemax-user-agent", "ScaleMax-OpenClaw/1.0`n") ``` Merge this SecretRef block into `~/.openclaw/openclaw.json` (Windows: `%USERPROFILE%\.openclaw\openclaw.json`) once: ```json5 secrets: { providers: { scalemax_cli: { source: "file", path: "~/.openclaw/secrets/scalemax-api-key", mode: "singleValue" }, scalemax_cli_user_agent: { source: "file", path: "~/.openclaw/secrets/scalemax-user-agent", mode: "singleValue" } } } ``` ## Manual configuration for Codex models in OpenClaw Merge this alternative provider into the same JSON5 file. For an OpenAI token-pack key, change only `baseUrl` to `https://api.scalemax.pro/token/v1`. ```json5 models: { mode: "merge", providers: { "scalemax-codex": { baseUrl: "https://api.scalemax.pro/v1", apiKey: { source: "file", provider: "scalemax_cli", id: "value" }, api: "openai-responses", request: { headers: { "User-Agent": { source: "file", provider: "scalemax_cli_user_agent", id: "value" } }, allowPrivateNetwork: false }, models: [ { id: "gpt-6.1-sol", name: "GPT-6.1 Sol" }, { id: "gpt-6-sol", name: "GPT-6 Sol" }, { id: "gpt-6-luna", name: "GPT-6 Luna" }, { id: "gpt-6-astra", name: "GPT-6 Astra" }, { id: "gpt-5.6-terra", name: "GPT-5.6 Terra" }, { id: "gpt-5.6-sol", name: "GPT-5.6 Sol" }, { id: "gpt-5.6-luna", name: "GPT-5.6 Luna" } ] } } }, agents: { defaults: { model: { primary: "scalemax-codex/gpt-5.6-terra" }, utilityModel: "scalemax-codex/gpt-5.6-luna" } } ``` The `openai-responses` adapter is required for Codex tool events. Do not list these models under `anthropic-messages`. ## Manual configuration for DeepSeek V4 Flash in OpenClaw Merge this as a third provider. For a DeepSeek token-budget key, change only `baseUrl` to `https://api.scalemax.pro/token/v1`. ```json5 models: { mode: "merge", providers: { "scalemax-deepseek": { baseUrl: "https://api.scalemax.pro/v1", apiKey: { source: "file", provider: "scalemax_cli", id: "value" }, api: "openai-completions", maxTokens: 4096, request: { headers: { "User-Agent": { source: "file", provider: "scalemax_cli_user_agent", id: "value" } }, allowPrivateNetwork: false }, models: [ { id: "deepseek-v4-flash", name: "DeepSeek V4 Flash", reasoning: true, input: ["text"], maxTokens: 4096, compat: { supportsTools: true, supportsToolChoice: false, supportsReasoningEffort: true, supportsUsageInStreaming: true, maxTokensField: "max_tokens", requiresReasoningContentOnAssistantMessages: true } } ] } } }, agents: { defaults: { model: { primary: "scalemax-deepseek/deepseek-v4-flash" }, utilityModel: "scalemax-deepseek/deepseek-v4-flash" } } ``` `deepseek-v4-flash` is available through ScaleMax's `/v1/chat/completions` contract, not `/v1/responses`. Use the agent flags above only when your authenticated `/v1/models` entry reports `capabilities.tools=true`. Thinking-mode tool loops require exact `reasoning_content` replay and reject `tool_choice`, which is why both compatibility flags are explicit. If discovery reports `tools=false`, set `reasoning: false` and `compat: { supportsTools: false }`, or use Continue Chat/Edit. `scalemax update` performs this capability selection automatically. Use only the customer's ScaleMax key; no upstream credential belongs on their device. ## Manual configuration for Claude models in OpenClaw Use this alternative for Claude. For a Claude token-pack key, change only `baseUrl` to `https://api.scalemax.pro/token`. The Messages adapter appends `/v1/messages`, so its base URL must not end in `/v1`. ```json5 models: { mode: "merge", providers: { "scalemax-claude": { baseUrl: "https://api.scalemax.pro", apiKey: { source: "file", provider: "scalemax_cli", id: "value" }, api: "anthropic-messages", maxTokens: 4096, request: { headers: { "User-Agent": { source: "file", provider: "scalemax_cli_user_agent", id: "value" } }, allowPrivateNetwork: false }, models: [ { id: "fable-5", name: "Fable 5", contextWindow: 1050000, maxTokens: 4096 }, { id: "claude-haiku-4-5-20251001", name: "Claude Haiku 4.5", contextWindow: 200000, maxTokens: 4096 }, { id: "claude-haiku-5-5", name: "Claude Haiku 5.5", contextWindow: 1000000, maxTokens: 128000 }, { id: "claude-opus-4-6", name: "Claude Opus 4.6", contextWindow: 200000, maxTokens: 4096 }, { id: "claude-opus-4-7", name: "Claude Opus 4.7", contextWindow: 200000, maxTokens: 4096 }, { id: "claude-opus-4-8", name: "Claude Opus 4.8", contextWindow: 200000, maxTokens: 4096 }, { id: "claude-opus-5", name: "Claude Opus 5", contextWindow: 1000000, maxTokens: 128000 }, { id: "claude-opus-5-5", name: "Claude Opus 5.5", contextWindow: 1000000, maxTokens: 128000 }, { id: "claude-sonnet-5", name: "Claude Sonnet 5", contextWindow: 200000, maxTokens: 4096 }, { id: "claude-sonnet-5-5", name: "Claude Sonnet 5.5", contextWindow: 1000000, maxTokens: 128000 } ] } } }, agents: { defaults: { model: { primary: "scalemax-claude/claude-opus-5" }, utilityModel: "scalemax-claude/claude-haiku-4-5-20251001" } } ``` The provider keeps a conservative `4096`-token default for older entries. Claude Opus 5's per-model `128000` value overrides that default and reflects its native output limit; lower it if you want a smaller per-response budget. ## Verify with the built-in probe **macOS / Linux** ```bash openclaw config validate openclaw secrets audit --check openclaw models list openclaw models status --probe --probe-max-tokens 1 --probe-timeout 60000 --json openclaw infer model run --model scalemax-deepseek/deepseek-v4-flash --prompt "Reply with K only." --json scalemax update ``` **Windows PowerShell** ```powershell openclaw config validate openclaw secrets audit --check openclaw models list openclaw models status --probe --probe-max-tokens 1 --probe-timeout 60000 --json openclaw infer model run --model scalemax-deepseek/deepseek-v4-flash --prompt "Reply with K only." --json scalemax.cmd update ``` Run the DeepSeek model command only when that provider is configured. After a text probe passes, ask it to use one harmless read-only tool and confirm the tool result is returned before enabling write or shell tools. OpenClaw 2026.7.1 can materialize resolved SecretRefs in its private generated agent cache during a probe; the final `scalemax update` scrubs that generated copy and restores the file-backed source of truth. ## Keep the key private > Never paste the real key into `openclaw.json`, a workspace environment file, or a support transcript. Keep the SecretRef files user-only and leave `allowPrivateNetwork` disabled for the public ScaleMax gateway. See [OpenClaw's custom-provider reference](https://docs.openclaw.ai/concepts/model-providers#providers-via-modelsproviders-custombase-url).