macaroon-bakery
Bake, inspect, and manage lnd macaroons for least-privilege agent access. Use when an agent needs scoped credentials — pay-only, invoice-only, read-only, or custom permissions. Also covers signer macaroon scoping and macaroon rotation.
Install via CLI (Recommended)
clawhub install openclaw/skills/skills/roasbeef/lnd-macaroon-bakeryMacaroon Bakery
Bake custom lnd macaroons so every agent gets only the permissions it needs.
Never hand out admin.macaroon in production — bake a scoped one instead.
Quick Start
# Bake a pay-only macaroon
skills/macaroon-bakery/scripts/bake.sh --role pay-only
# Bake an invoice-only macaroon
skills/macaroon-bakery/scripts/bake.sh --role invoice-only
# Bake a read-only macaroon
skills/macaroon-bakery/scripts/bake.sh --role read-only
# Inspect any macaroon
skills/macaroon-bakery/scripts/bake.sh --inspect ~/.lnd/data/chain/bitcoin/mainnet/admin.macaroon
# List all available lnd permissions
skills/macaroon-bakery/scripts/bake.sh --list-permissions
Docker
The litd container is auto-detected. You can also specify --container:
# Auto-detect litd container (default)
skills/macaroon-bakery/scripts/bake.sh --role pay-only
# Explicit container
skills/macaroon-bakery/scripts/bake.sh --role pay-only --container litd
# Inspect a macaroon inside a container
skills/macaroon-bakery/scripts/bake.sh --inspect /root/.lnd/data/chain/bitcoin/testnet/admin.macaroon --container litd
Remote Nodes
To bake macaroons on a remote lnd node, provide the connection credentials:
# Bake a pay-only macaroon on a remote node
skills/macaroon-bakery/scripts/bake.sh --role pay-only \
--rpcserver remote-host:10009 \
--tlscertpath ~/remote-tls.cert \
--macaroonpath ~/remote-admin.macaroon \
--save-to ~/remote-pay-only.macaroon
You need lncli installed locally and copies of the node's TLS cert and a macaroon
with macaroon:generate permission (typically admin.macaroon).
Preset Roles
| Role | What the agent can do | Cannot do |
|---|---|---|
pay-only | Pay invoices, decode invoices, get node info | Create invoices, open channels, see balances |
invoice-only | Create invoices, lookup invoices, get node info | Pay, open channels, see wallet balance |
read-only | Get info, balances, list channels/peers/payments | Pay, create invoices, open/close channels |
channel-admin | All of read-only + open/close channels, connect peers | Pay invoices, create invoices |
signer-only | Sign transactions, derive keys (for remote signer) | Everything else |
Baking Custom Macaroons
For permissions not covered by presets, bake a custom macaroon:
# Custom: agent can only pay and check wallet balance
skills/macaroon-bakery/scripts/bake.sh --custom \
uri:/lnrpc.Lightning/SendPaymentSync \
uri:/lnrpc.Lightning/DecodePayReq \
uri:/lnrpc.Lightning/WalletBalance \
uri:/lnrpc.Lightning/GetInfo
# Custom with explicit output path
skills/macaroon-bakery/scripts/bake.sh --custom \
uri:/lnrpc.Lightning/AddInvoice \
uri:/lnrpc.Lightning/GetInfo \
--save-to ~/my-agent.macaroon
Discovering Permissions
# List all available URI permissions
skills/macaroon-bakery/scripts/bake.sh --list-permissions
Metadata
Not sure this is the right skill?
Describe what you want to build — we'll match you to the best skill from 16,000+ options.
Find the right skillPaste this into your clawhub.json to enable this plugin.
{
"plugins": {
"official-roasbeef-lnd-macaroon-bakery": {
"enabled": true,
"auto_update": true
}
}
}Related Skills
lnd
Install and run Lightning Terminal (litd) which bundles lnd, loop, pool, tapd, and faraday in a single Docker container. Defaults to neutrino backend with SQLite storage on testnet. Supports watch-only mode with remote signer, standalone mode, and regtest development. Use when setting up a Lightning node for payments, channel management, liquidity management (loop), channel marketplace (pool), taproot assets (tapd), or enabling agent L402 commerce.
aperture
Install and run Aperture, the L402 Lightning reverse proxy from Lightning Labs. Use when creating L402 paywalls, configuring paid API endpoints, hosting paid content for other agents, or testing L402 authentication flows.
lightning-mcp-server
Build and configure the MCP server for Lightning Node Connect (LNC). Connects AI assistants to lnd nodes via encrypted WebSocket tunnels using pairing phrases — no direct network access or TLS certs needed. Read-only by default (18 tools for querying node state, channels, payments, invoices, peers, on-chain data).
lnget
Install and use lnget, a Lightning-native HTTP client with automatic L402 payment support. Use when downloading files behind Lightning paywalls, managing L402 tokens, checking Lightning backend status, or making HTTP requests that may require micropayments.
commerce
End-to-end agentic commerce workflow using Lightning Network. Use when an agent needs to set up a full payment stack (lnd + lnget + aperture), buy or sell data via L402, or enable agent-to-agent micropayments.