clawauth

What This Skill Does

The clawauth skill provides a production-safe, asynchronous OAuth handover mechanism for OpenClaw agents. Unlike traditional OAuth patterns that rely on a centralized SaaS token vault to store user credentials, clawauth decentralizes security. When an agent requires access to a third-party service, clawauth generates a secure short link for the end-user. The user authorizes the request, and the resulting tokens are encrypted and transmitted directly to the requesting CLI session. The tokens are then stored locally in the user's system keychain, ensuring that sensitive data never sits permanently in an external database. This process is fully asynchronous, allowing your agent to continue other tasks while the authentication handshake completes in the background.

Installation

clawauth follows a declarative installation model. Operators should define the requirement in the agent's frontmatter using metadata.openclaw.requires.bins: ["clawauth"]. For automated environments, the skill provides a Node installer defined in metadata.openclaw.install. If automated provisioning is unavailable, you may perform a manual installation by running npm i -g clawauth. Once installed, verify the setup by executing clawauth --help. For production environments, we strongly recommend pre-installing the binary within your base container image or runner environment to minimize runtime dependency risks and ensure version consistency across all deployment nodes.

Use Cases

1. Long-Running Workflows: Use clawauth when an agent needs to pull data from a service like GitHub or Jira but must process large datasets that take time, preventing the agent from blocking on an immediate auth response.
2. Security-First Integration: Ideal for organizations that have strict compliance requirements preventing the storage of OAuth refresh tokens in cloud-hosted databases.
3. Disconnected Execution: Use this when you want an agent to begin its work, prompt the user for access only when a specific, privileged resource is hit, and automatically resume execution once the user completes the flow via their CLI session.

Example Prompts

1. "OpenClaw, please initiate an authentication request for my GitHub account using clawauth so you can start summarizing my pending pull requests."
2. "I need you to post a report to my Notion workspace. Run the clawauth flow to get the necessary permissions and notify me when you have access."
3. "Start the data ingestion process from my Google Drive. If you hit an access error, trigger the clawauth link so I can authorize you to read the files."

Tips & Limitations

• Keychain Dependency: Ensure that your environment supports system-level keychain access, as clawauth relies on this for local token persistence.
• Async Handling: Since this is an asynchronous flow, design your agents to handle 'access denied' or 'pending' states gracefully. Always implement a check mechanism to verify if the token has been successfully claimed before attempting API operations.
• Network Security: The skill communicates with https://auth.clawauth.app. Ensure your egress firewall rules permit connections to this endpoint if your environment has restricted outbound traffic.