Give OpenClaw your OpenAI key, not your Stripe key

Most setups hand an agent every key in the file. MoltenRock lets you decide key by key, and shows you each time one is used.

Download MoltenRock · Free See it in action

The short answer

To limit what OpenClaw can use, grant it keys one at a time from a vault instead of giving it a file full of them. In MoltenRock, each key is granted to each agent separately: OpenClaw can resolve your OpenAI key without ever seeing your Stripe key. Every release is logged, you can remove one key from an agent, and unpairing revokes everything at once.

The problem

All-or-nothing access is the default

One file, every key
Whatever is in the config is available to the agent.
One leak, every key
If the agent is tricked into revealing its config, it reveals all of it.
No record
Nothing shows which key the agent actually used.

How MoltenRock handles it

Key by key, agent by agent

Per-key grants
Choose which keys OpenClaw may resolve. Everything else stays sealed.
Logged releases
Each time OpenClaw resolves a key, the Activity log records it.
Revoke in one click
Remove a single key, or unpair the agent to revoke everything.
Separate lanes
Email tokens never grant API keys, and keys added for MoltenRock Connect are never shared with OpenClaw.

How it works

Set it up

01
Pair OpenClaw
OpenClaw → Add OpenClaw agent → Pair.
02
Choose its keys
Only the ones it needs, for example the model key.
03
Watch the log
See each release; remove what it never uses.

Straight answer

What OpenClaw gets

Stays on your Mac

Every key you didn’t grant
Your MoltenRock Connect keys and your mail, which are separate lanes
The log of every release

Leaves your Mac

The keys you granted, to OpenClaw, when it resolves them
The calls OpenClaw makes with them
Nothing to a MoltenRock server

Questions

What people ask first

Can OpenClaw ask for a key I didn’t grant?

It can ask; the request is denied and logged.

Do I need to restart OpenClaw after changes?

After migrating keys, run openclaw secrets reload so the gateway picks them up.

Does this work for Hermes too?

Yes. Hermes gets its own grants on the Hermes screen.

What does it cost?

Free with 3 keys and 1 agent; Pro is unlimited from $9.99 a month.

The right key for the right agent.

Free for Mac. No account, no cloud, no telemetry.