Fastest
Start with a hosted model
No server to run. Bring an OpenRouter key and you’re chatting in minutes - try Conduck before hosting your own.
Chat and images only - no tools, files, or memory.
Conduck is the client - you bring the AI it talks to, either a gateway you host or a hosted model. This page takes you from nothing to your first message.
Two ways to start
No server to run. Bring an OpenRouter key and you’re chatting in minutes - try Conduck before hosting your own.
Chat and images only - no tools, files, or memory.
Run any server on an always-on machine you control - a VPS, or a Mac mini at home.
Any OpenAI-compatible endpoint, reachable over HTTPS.
Any server works if it speaks the OpenAI chat API over HTTPS and accepts a token. Conduck sends three things:
POST /v1/chat/completionssends a message, gets the replyGET /v1/modelslists the available modelsAuthorization: Bearera token, or explicit keyless accessWhat comes back matters too: the model list wrapped in a "data" array, and the answer as plain text - not a stream.
Ollama · LM Studio · LiteLLM · vLLM
Connects and chats. Conduck does not execute returned tool calls or add memory.
OpenClaw · Hermes
The full assistant — runs the complete agent turn server-side: tools, files, and memory across chats.
A small VPS, or an always-on machine at home (Mac mini, NUC, Raspberry Pi). It has to stay awake - your phone sleeps, your gateway shouldn’t. 4 GB of RAM is plenty.
Install the AI gateway of your choice. OpenClaw and Hermes are two good options, but any OpenAI-compatible server works - follow that project’s own guide, which the maintainers keep current. Built your own AI? Follow the adapter contract.
Anthropic, OpenAI, Gemini, OpenRouter - whichever your gateway routes to. You pay the provider directly, and the key lives only on your own gateway.
Conduck needs your gateway’s OpenAI-compatible chat endpoint enabled and reachable over HTTPS. The easy way: run conduck-connect once on the host - it catches the common “chat endpoint off” failure, helps with HTTPS, runs real test requests, and prints a setup code once everything passes. Prefer to do it yourself? Enable the endpoint, expose a valid HTTPS hostname, and keep the gateway token handy.
However you expose HTTPS, use your gateway’s DNS hostname - not a raw IP.
Open Settings → Personal AI. If you ran conduck-connect, scan or paste its setup code. If you set the gateway up yourself, add it by hand with its HTTPS URL and token. The token stays in your device’s Apple Keychain - Conduck never sends it to us. That’s it.
curl -fsSLO https://github.com/gigaduckai/conduck-connect/releases/latest/download/conduck-connect.sh && bash conduck-connect.sh The handful of things that trip people up - and the one-line fix.
Conduck accepts https:// only - a plain http:// address (the default for Ollama and LM Studio) is rejected at save. And “localhost” on your phone means the phone itself; most local servers also listen on 127.0.0.1 alone. Put HTTPS in front and expose the server - conduck-connect does both - then connect with that hostname. For addresses on your home network, iOS also needs Conduck’s Local Network permission (in the iOS Settings app).
An HTML page usually means the chat endpoint is still off - it ships off by default on OpenClaw and Hermes. Re-run conduck-connect, or enable it in your gateway’s config and restart. Behind a tunnel or reverse proxy it can also be a login or access page answering instead of your gateway. If it’s JSON but Conduck still refuses, the shape is wrong: the reply must be an object with a top-level "data" array - see the adapter contract.
The bearer token is wrong or missing. Copy it again from your gateway and re-pair. If the token is definitely right, check what sits in front - a reverse proxy or access policy (e.g. Cloudflare Access) can reject the request before your gateway ever sees it.
A self-signed or expired cert. conduck-connect pins a valid self-signed cert for you; an expired one has to be renewed first. If you’ve replaced a pinned cert since pairing, run conduck-connect again so the app pins the new one.
Servers like Ollama, vLLM, and LiteLLM need the model named in every request - set it in the gateway’s settings in Conduck (Test Connection suggests what your server offers). A 404 when sending usually means that model isn’t available on the server: not pulled or loaded yet, or the name doesn’t match. An empty model list means the endpoint is real but has nothing to answer with - load a model first.
You’re pointed at a chat endpoint, not an agent - and nothing errors, which is what makes this one easy to miss. On Hermes, pair the full-agent API server (port 8642 by default), not the tool-less “hermes proxy” on 8645: both chat, only the API server carries tools, skills, and memory. And a plain model endpoint - Ollama, LM Studio, vLLM, LiteLLM - only ever chats; Conduck doesn’t execute the tool calls it returns. See what your server can do.
A passing file-server test proves Conduck can store bytes - not that your agent may use them. The gateway’s tool policy decides that: on OpenClaw, a tools.deny containing group:fs makes every upload invisible to the agent (it web-searches for the filename, or the turn times out into “no response”), reading PDFs natively needs the pdf tool enabled, and saving files back needs write allowed. Separately, a file the agent “sends” as a MEDIA:-style attachment directive is stripped by the chat endpoint - it must name the file in plain reply text instead. Re-run conduck-connect: its file-lane step checks the tool policy, offers the exact fix, and installs agent guidance covering all of this (new conversations only - agent guidance loads at session start). Details: file-lane troubleshooting.
With your iPhone nearby, the Watch reaches the gateway through your phone, so a Tailscale-only gateway works. A standalone Watch - away from your iPhone, on its own Wi-Fi or cellular - can’t reach a Tailscale-only gateway. For that, expose it with Funnel, Cloudflare Tunnel, or your own HTTPS so the Watch connects directly.
402 means your OpenRouter account needs credit; 429 means you’re being rate-limited - wait it out, or add credit to lift the free-tier caps. And conduck-connect refuses to publish a keyless gateway by design (adding one by hand, the app warns instead) - keep keyless gateways on a private network, or add a token.