OpenClaw with a ChatGPT or Codex subscription

People searching for OpenClaw with a ChatGPT Plus, Business or Codex plan are asking whether the subscription they already pay for can drive the agent. The docs answer yes, with a shape worth understanding: one provider id covers both a Platform API key and a ChatGPT or Codex subscription, the subscription signs in through OAuth, and the agent models route through OpenAI’s native harness when the route qualifies. Here is the sign-in, the model route, what the subscription covers and what still needs a key, and the repair for old config.

OpenAI explicitly supports subscription OAuth usage in external tools and workflows like OpenClaw.

The sign-in

• Run onboarding with the OpenAI auth choice, or the models auth login command for the OpenAI provider; a browser sign-in completes on the Gateway host.
• On a headless or callback-hostile host, add the device-code flag to sign in with a ChatGPT device code instead of the localhost browser callback.
• Verify with the models list for the provider, and once the Gateway runs, with the Codex status and Codex models commands in chat, which confirm the native app-server runtime.

The model route

Set the primary model to the canonical OpenAI reference, the docs’ example being the GPT-6 Astra route. No runtime config is required: with runtime policy unset, an exact official HTTPS native route may select the Codex app-server runtime automatically, and OpenClaw installs or repairs the bundled Codex plugin when that runtime is chosen. The prefix alone never selects a runtime; a custom endpoint, an authored Completions transport or a plaintext official endpoint stays on the embedded runtime or is rejected outright. Some catalog entries, a spark-tier coding model among them, exist only through the subscription catalog and are not exposed on the API-key route.

What the subscription covers, and what does not

• Agent turns: the openai routes through the Codex runtime or the embedded runtime with an internal Codex-auth transport, on the signed-in profile.
• Not the non-agent surfaces: images, embeddings, speech, transcription and realtime go through the OpenAI Platform, billed per use, and need an API key or an API-key auth profile.
• Legacy references to the old codex provider ids are repaired to the canonical route plus a model-scoped runtime setting by the doctor’s fix flag.

Hermes and the Codex runtime is the same idea on the Hermes side, and OpenClaw models and providers explains how OpenClaw resolves references and fails over between providers.

What it means for the bill

A subscription that already covers the agent’s turns changes the monthly picture more than any model choice, and the docs’ coverage page reports subscription quota and Platform billing separately for that reason. What OpenClaw costs is where to put the number.

On Diali

On Diali credits are included and the OpenAI models are in the managed catalog, so a subscription is not required; bringing a key of your own is the option for Platform billing. Hosted OpenClaw on Diali is the assistant and Diali pricing shows what the credits cover.

• One provider id, two auth paths, OAuth for the subscription.
• The canonical route may pick the Codex runtime by itself.
• Images, speech and embeddings still want a key.