Authentication

Telem authenticates requests with a bearer token and points at a deployment via a base URL. Both are controlled by the same two settings everywhere — the SDK, the MCP server, and every agent integration — and both resolve the same way.

TELEM_API_KEY

TELEM_API_KEY is optional for open deployments. When it’s set, requests carry an Authorization: Bearer <key> header. When it’s unset, no Authorization header is sent at all — the client never treats a missing key as an error by itself.

The public hosted default (https://router.telem.ai) is not one of those open deployments: it requires a key, and an unauthenticated request gets 401 {"detail": "Missing API key"}. Some self-hosted deployments may still be configured to run open (an admin can leave the anonymous path enabled), which is what the SDK’s “no key, no header, no client-side error” behavior above supports — but that is a property of a given self-hosted deployment’s configuration, not of the hosted service.

There’s no public dashboard for issuing keys yet — contact the Telem team for one if your deployment requires it.

TELEM_BASE_URL

Defaults to the hosted deployment, https://router.telem.ai, when unset. Point it at a staging or self-hosted deployment by setting the environment variable (or passing base_url directly in code).

Resolution order

Both settings resolve the same way, first match wins:

1. Explicit argument — Telem(api_key=..., base_url=...) in code, or the equivalent per-surface config value (e.g. an OpenClaw plugin config entry).
2. Environment variable — TELEM_API_KEY / TELEM_BASE_URL.
3. Default — no default for TELEM_API_KEY (unset means no auth header at all); https://router.telem.ai for TELEM_BASE_URL.

Keeping your key safe

Treat TELEM_API_KEY like any other credential:

• Set it as an environment variable, or in a .env-style file kept outside version control — e.g. ~/.openclaw/.env for OpenClaw, or your shell profile for local SDK use.
• Never write it into a config file that gets committed to VCS.
• Prefer the environment over plaintext config wherever a surface supports both.