Quickstart

Deploy your first AI agent on Pai in under 5 minutes.

Prerequisites

• pai CLI installed and logged in (see Getting Started)
• A Gemini API key — get one free at aistudio.google.com

Step 1: Store your API key

pai add secret gemini-key --from-literal api-key=YOUR_GEMINI_API_KEY

Secrets are encrypted at rest and never exposed to the agent container.

Step 2: Add a model

pai add model gemini-flash \
  --provider gemini \
  --api-key gemini-key \
  --max-tokens-day 1000000 \
  --max-tokens-request 32000

Verify:

pai get models
# NAME           PROVIDER   MODEL               MAX/DAY     AGE
# gemini-flash   gemini     gemini-2.5-flash     1000000     5s

Step 3: Deploy an agent

Create my-agent.yaml:

apiVersion: pai.io/v1
kind: AgentWorkload
metadata:
  name: my-agent
spec:
  image: ghcr.io/pai-platform/openclaw:latest
  runAsUser: 1000
  modelBindings:
    - gemini-flash
  inbound:
    port: 18789
    allowCIDRs:
      - "0.0.0.0/0"   # restrict to your IP in production
  volumes:
    - name: openclaw-home
      mountPath: /home/node/.openclaw
      size: "5Gi"
    - name: workspace
      mountPath: /home/node/workspace
      size: "10Gi"
  configFiles:
    - path: /home/node/.openclaw/openclaw.json
      content: |
        {
          "agents": {
            "defaults": {
              "model": {
                "primary": "google/gemini-flash-2-5",
                "fallbacks": []
              }
            }
          },
          "browser": {
            "enabled": true,
            "attachOnly": true,
            "cdpUrl": "http://localhost:8082"
          }
        }
    - path: /home/node/.openclaw/agents/main/agent/auth-profiles.json
      content: |
        {
          "google-gemini": {
            "provider": "google",
            "mode": "api-key",
            "key": "pai-managed"
          }
        }
  resources:
    requests:
      cpu: "500m"
      memory: "512Mi"
    limits:
      cpu: "2"
      memory: "2Gi"

pai create -f my-agent.yaml

Step 4: Wait for it to start

pai status my-agent
# NAME       STATUS    URL                            TOKENS/DAY   AGE
# my-agent   Running   https://a7x3k9.pairun.dev      0            30s

Every agent gets a unique public HTTPS URL automatically.

Step 5: Open the UI

Copy the URL from pai list or pai status and open it in your browser:

pai list
# NAME       STATUS    URL                            AGE
# my-agent   Running   https://a7x3k9.pairun.dev      45s

What's next?

• Read the Agent reference to see all available configuration options
• Add a Provider to give your agent access to GitHub, Telegram, or other services
• Set up browser automation with the CDP relay