token-management

What This Skill Does

The token-management skill provides a robust, centralized framework for handling API credentials within your local environment. Instead of scattering sensitive keys across various scripts or relying on memory, this skill standardizes the lifecycle of your tokens. It enforces a strict storage protocol in ~/Documents/life/.env, ensuring that all secrets are kept in one secure, canonical location. Beyond storage, the skill manages the entire token lifecycle: verifying permissions through targeted test scripts, documenting capabilities in individual connection files, and setting automated calendar reminders for expirations. By maintaining a clear audit trail of when a token was obtained, what scope it covers, and where it can be renewed, this skill eliminates "credential fatigue" and prevents the security risk of managing expired or legacy API keys.

Installation

To integrate this skill into your OpenClaw environment, execute the following command in your terminal:

clawhub install openclaw/skills/skills/nonlinear/token-management

Ensure that you have write permissions to your home directory, as the skill needs to modify ~/Documents/life/.env and create documentation files in ~/Documents/life/connections/.

Use Cases

• Automated Lifecycle Tracking: Automatically set 7-day expiry warnings in your calendar, ensuring you never face a sudden service outage due to an expired token.
• Centralized Documentation: Create a consistent knowledge base for every API service you integrate, mapping specific environment variables to their scopes, renewal links, and usage examples.
• Safety-First Credential Updates: Before overwriting any token, the skill encourages automated Git commits of your environment file, providing a rollback safety net.
• Permission Validation: Quickly assess what a new token can actually do by running custom test batteries, preventing hidden permission errors during production script execution.

Example Prompts

1. "adiciona token da OpenAI: sk-12345, expira em 2025-12-31"
2. "salva API key pra Jira, é o token do Wiley, renova anualmente"
3. "preciso de token pro Github, verifique se já tenho um salvo no meu .env"

Tips & Limitations

• Pre-check Protocol: The most important rule is to always check the existing .env file before prompts; avoid duplicating entries.
• Git Safety: Always initialize the ~/Documents/life/ folder as a Git repository to leverage the automatic commit-before-update feature.
• Environment Sensitivity: Remember that the file stored at ~/Documents/life/.env is sensitive. Ensure that any backup systems or cloud syncing you use for this directory are encrypted and secure.
• Adaptation: The provided test script templates are starting points. Always customize the endpoints in your connections/ scripts to reflect the real-world API architecture you are connecting to.