Keychains is a security-first credential proxy that allows AI agents to interact with thousands of APIs without ever seeing or storing sensitive keys or tokens.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install keychains
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install keychains using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Keychains?
Keychains acts as a secure intermediary for AI agents, replacing raw API keys and OAuth tokens with safe placeholders. By utilizing a server-side injection model, sensitive credentials remain in the user's secure vault at keychains.dev while the agent only handles template variables. This architecture ensures that even if an agent is compromised or logs are exposed, your real credentials stay protected.
Built to integrate seamlessly with Openclaw Skills, Keychains supports over 5,500 providers, including GitHub, Stripe, and Slack. It provides a developer-friendly CLI and SDKs that transform standard fetch and request calls into secure, proxied transactions with built-in user approval workflows. This approach maintains a strict boundary between the agent's logic and the user's private access data.
Keychains Use Cases
- Securely listing private GitHub repositories without exposing OAuth tokens to the LLM.
- Sending Slack messages or reading Gmail through an AI agent while maintaining user-level access control.
- Integrating financial data from Stripe or PayPal into an automated agent workflow without risking key exposure.
- Building secure multi-tenant AI applications where each user manages their own credentials via FaceID or Passkey.
How Keychains Works
- The agent invokes a command using keychains curl or the keychainsFetch() SDK method, passing a placeholder like {{OAUTH2_ACCESS_TOKEN}}.
- Upon the first request, Keychains detects the provider and returns a secure approval link instead of the API response.
- The user opens the link, authenticates via biometric security such as FaceID or Passkey, and connects their account.
- The agent replays the command; the Keychains proxy injects the real credential server-side and returns the raw API response to the agent.
Keychains Setup
To get started with this skill for Openclaw Skills, install the CLI globally:
npm install -g keychains@latest
Verify the installation by running a proxied request:
keychains curl https://api.github.com/user/repos -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
Keychains Data Schema & Taxonomy
Keychains uses a simple templating system to manage sensitive data without passing it to the agent environment. The following table describes how data is handled:
| Element | Description |
|---|---|
| Template Variables | Placeholders like {{STRIPE_SECRET_KEY}} or {{OAUTH2_ACCESS_TOKEN}} used in headers, body, or query params. |
| Approval URL | A unique link (e.g., https://keychains.dev/approve/abc123xyz) generated for user authorization. |
| Provider Detection | Automatic identification of the API provider based on the request URL. |
| Credential Vault | Secure server-side storage controlled by the user via the keychains.dev dashboard. |
Keychains Advanced Features
- Drop-in SDK replacements for native fetch() in TypeScript (@keychains/machine-sdk) and requests in Python.
- Support for a massive library of 5,545+ providers, ensuring compatibility with almost any web service.
- Automatic provider detection that maps URLs to the correct credential set without manual configuration.
- Biometric-backed authorization flows to ensure a human-in-the-loop for sensitive data access.
- Dedicated dashboard for managing active connections and viewing a full audit trail of agent activity.
SKILL.md
Loading
Related Openclaw Skills
Intellectia Stock Screener
A high-performance skill to fetch and summarize stock, ETF, and crypto screener data directly from the Intellectia API without requiring authentication.
qmd
A high-performance local indexing and search CLI that combines traditional keyword matching with semantic vector search and MCP support.
ddg
A high-performance CLI utility that enables privacy-focused DuckDuckGo web searches directly from your terminal or AI agent environment.
CloneV AI Voice Cloning
A high-fidelity voice cloning skill that generates natural speech from a short reference audio sample in 14+ languages.
Querit Search
A high-performance web search and content extraction tool for AI agents utilizing the Querit.ai API.
Get eSIM Skill
An AI-powered skill for purchasing global eSIM data plans using USDC on the Base network via the x402 protocol.
METADATA
Featured*
