diff --git a/packages/services/agent-service/src/infrastructure/services/agent-instance-deploy.service.ts b/packages/services/agent-service/src/infrastructure/services/agent-instance-deploy.service.ts
index 13a6252..58d4bf9 100644
--- a/packages/services/agent-service/src/infrastructure/services/agent-instance-deploy.service.ts
+++ b/packages/services/agent-service/src/infrastructure/services/agent-instance-deploy.service.ts
@@ -216,11 +216,13 @@ export class AgentInstanceDeployService {
     const sshCreds = { host: creds.host, port: creds.sshPort, username: creds.sshUser, privateKey: creds.sshKey };
     await this.sshExec(sshCreds, `mkdir -p /data/openclaw/${instance.id} && printf '%s' '${openclawConfig.replace(/'/g, "'\\''")}' > /data/openclaw/${instance.id}/openclaw.json`);
 
-    // Write gateway API key for LLM proxy in auth-profiles.json
+    // Write gateway API key for LLM proxy in auth-profiles.json.
+    // Must use effectiveApiKey (gateway key) so OpenClaw authenticates with the gateway,
+    // NOT the raw Anthropic key which the gateway does not recognize.
     const authProfiles = JSON.stringify({
       version: 1,
       profiles: {
-        'anthropic-api-key': { type: 'api_key', provider: 'anthropic', key: claudeApiKey },
+        'anthropic-api-key': { type: 'api_key', provider: 'anthropic', key: effectiveApiKey },
       },
     });
     await this.sshExec(sshCreds, `mkdir -p /data/openclaw/${instance.id}/agents/main/agent && printf '%s' '${authProfiles.replace(/'/g, "'\\''")}' > /data/openclaw/${instance.id}/agents/main/agent/auth-profiles.json`);