How it works
Setup
1
Generate an API key
Go to Data in Weave, find Hermes (or OpenClaw, Pi, or AI Gateway) under the AI section, and create a new API key. Hermes keys start with
whrmkey_, OpenClaw keys start with wockey_, Pi keys start with wpikey_, AI Gateway keys start with wagkey_.One org-level key covers all users. Per-person attribution happens via the
user.email attribute on each record.2
POST to the ingest endpoint
Hermes only needs logs:OpenClaw uses both metrics and optional logs:Both
application/json and application/x-protobuf are accepted.3
Validate your payloads
The endpoint returns a If records are missing fields, you’ll see something like:All records are still ingested —
partialSuccess block when records are missing required attributes. A successful payload returns either no partialSuccess key at all, or one with all zeros:partialSuccess is advisory, flagging records that won’t populate dashboards.4
Verify data
Run a few requests, then check your AI report. Data appears after the next hourly refresh (up to ~60 minutes). Log records with valid attributes populate the token usage and cost charts.
Payload reference
Hermes (logs only)
Endpoint:POST /ingest/v1/logs
Example —
hermes.api_request:
hermes.user_prompt (optional):
Pi / Oh My Pi (traces only)
Endpoint:POST /ingest/v1/traces
Oh My Pi exports OTLP/HTTP protobuf traces. Weave persists completed chat {model} spans (or any span with gen_ai.operation.name = "chat"). Metrics and logs are accepted and discarded.
gen_ai.usage.input_tokens includes cache buckets. Weave stores uncached input as input_tokens - cache_read - cache_creation.
* One identity attribute is required. Upstream Oh My Pi emits none of them on its own — its chat spans carry model, token, and cost data only — so supply user.email through the OTel resource:
OTEL_RESOURCE_ATTRIBUTES is W3C Baggage, , and = act as separators and cannot appear in the address.
Authenticate with X-Weave-Token: wpikey_.... Point Oh My Pi at /ingest with OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf.
AI Gateway (logs only)
Endpoint:POST /ingest/v1/logs
Use this integration to report telemetry from a custom AI model gateway (e.g., an AWS Bedrock proxy, a self-hosted LiteLLM gateway, or any OpenAI-compatible intermediary). The gateway sends one log record per model inference request.
weave.token (sent as X-Weave-Token) authenticates to Weave only — it has no relationship to
your gateway’s upstream provider credentials. If your gateway sits in front of AWS Bedrock
(rotating STS/temporary credentials) or another provider with its own key-rotation schedule,
rotating those upstream credentials has no effect on this token, and rotating this token has no
effect on your provider auth. The only way to rotate weave.token is to generate a new AI
Gateway API key in Weave.Requests are deduplicated on
(organization_id, external_account_id, model, timestamp). If your
gateway retries or replays a request with the same user, model, and timestamp, the later write
overwrites the earlier one. Include a high-resolution timestamp (e.g., include sub-second
precision or a unique request_id) to avoid collisions when a single user sends multiple requests
to the same model at the same second.ai_gateway.api_request:
OpenClaw
Metrics (required —POST /ingest/v1/metrics):
openclaw.token values: input, output, cache_read, cache_write, cache_creation.
Example — metrics payload:
POST /ingest/v1/logs):
Example —
openclaw.user_prompt:
Multiple tenants in one batch
EachResourceLogs (or ResourceMetrics) can carry its own weave.token resource attribute. Weave routes and validates per-resource, so a single batch can mix Hermes, AI Gateway, and OpenClaw data — or even multiple organizations — as long as each resource has its own token.
We validate each distinct resource token once before queueing the request; repeated resources using the same token do not trigger repeated key lookups. Mixed-tenant requests are accepted above 32 distinct tokens. The decompressed request body is limited to 6 MiB and each request can contain up to 4,096 resource groups. Requests over either limit receive HTTP 413 and are not queued, so collectors should keep exports within both limits and split oversized requests before sending them. An invalid or deleted X-Weave-Token header returns HTTP 401. Invalid resource-level weave.token values reject only their associated resource groups and are reported through OTLP partial success; valid groups can still be queued with HTTP 200. Temporary authentication-store or queue failures return retryable HTTP 503.
Troubleshooting
200 OK but no data in Weave
200 OK but no data in Weave
- Check the
partial_success(orpartialSuccessin JSON) field — if records are rejected, the message tells you why (missinguser.account_id,cost_usd, etc.) - Data shows up on the next hourly dashboard refresh — it may take up to ~60 minutes to appear
- Verify the API key prefix matches the tool:
whrmkey_for Hermes,wockey_for OpenClaw,wagkey_for AI Gateway. Wrong prefix = dropped - Ensure
user.emailmatches an email in your Weave organization so data attributes to the right person
401 Unauthenticated
401 Unauthenticated
The
X-Weave-Token header is invalid, unrecognized, or deleted. Rotating a key in Weave invalidates the old one immediately, so clients still sending it in the header get 401. An invalid resource-level weave.token is handled separately: its resource groups are reported as rejected through OTLP partial success, while valid groups can still be accepted. Update every place the key is configured: collector headers, managed-settings.json, and OTEL_RESOURCE_ATTRIBUTES.Records rejected with 'missing user.account_id, model, cost_usd...'
Records rejected with 'missing user.account_id, model, cost_usd...'
Hermes
api_request events must include user.account_id, model, cost_usd, and duration_ms. Records missing any of these are flagged but still ingested — they just won’t populate dashboards until the fields are included.200 OK but data appears on wrong day or not at all
200 OK but data appears on wrong day or not at all
Check the
timeUnixNano field — it’s nanoseconds since Unix epoch. Missing or zero timestamps can cause data to land on the wrong day or be skipped.