A secure intermediary that executes authenticated API calls without exposing sensitive keys to the AI agent.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install keys
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install keys using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Keys: Secure API Broker?
The Keys skill is a specialized security tool designed for Openclaw Skills users who need to perform authenticated API operations safely. It functions as a broker, meaning the AI agent never sees or handles the actual API keys. Instead, the agent sends request parameters to the broker, which then pulls the required token from the system's secure keychain to complete the transaction. This architecture is essential for maintaining high security standards when building with Openclaw Skills.
By isolating credentials from the LLM context window, Keys effectively mitigates the risk of accidental key exposure or intentional exfiltration. It provides a secure bridge between the agent's logic and protected external services like OpenAI, Anthropic, and GitHub, ensuring that your automated workflows remain safe and professional.
Keys: Secure API Broker Use Cases
- Making secure calls to LLM providers like OpenAI or Anthropic without the risk of token leakage.
- Managing Stripe financial operations or GitHub repository updates through an agentic interface.
- Automating authenticated tasks in environments where security is the top priority for Openclaw Skills.
- Centralizing API credential management for multiple local AI agents and workflows.
How Keys: Secure API Broker Works
- The user stores API credentials in the native OS keychain using the management scripts provided.
- When an action is required, the agent sends a request payload to the keys-broker specifying the service and endpoint.
- The broker checks the request against a pre-configured whitelist of allowed URLs to prevent data exfiltration.
- Upon validation, the broker retrieves the key from the secure keychain and attaches it to the request header.
- The request is executed via curl, and the broker returns the sanitized API response back to the Openclaw Skills environment.
Keys: Secure API Broker Setup
To begin using Keys with your Openclaw Skills setup, ensure your environment supports local keychain access (Linux or macOS). Note that this skill is not compatible with Docker or WSL.
# Ensure dependencies are installed
# For Linux: sudo apt-get install jq curl
# Initialize the keys broker and set up the script
./keys-broker.sh setup
# Securely add your first API key to the keychain
keys-broker set openai YOUR_API_KEY_HERE
Keys: Secure API Broker Data Schema & Taxonomy
The skill uses a minimalist and secure data schema to manage authorized services and their endpoints.
| Component | Description |
|---|---|
| ALLOWED_URLS | A whitelist of domains (e.g., api.openai.com) the broker is permitted to contact. |
| Keychain Storage | The primary encrypted storage for credentials, utilizing macOS Keychain or Linux Secret Service. |
| Broker Payload | A JSON structure containing action, service, url, method, and body for the request. |
Keys: Secure API Broker Advanced Features
- Strict URL whitelisting to prevent unauthorized API requests and SSRF attacks.
- Zero-exposure architecture where tokens never enter the LLM context, chat history, or logs.
- Local keychain integration for hardware-level security on supported operating systems.
- Support for rotating and managing keys across various Openclaw Skills projects without changing agent logic.
SKILL.md
Loading
Related Openclaw Skills
Linux Kernel Guardrails
A specialized technical resource for preventing common Linux kernel development pitfalls like context violations and memory errors.
Keras
A comprehensive deep learning skill for building, training, and troubleshooting neural networks using Keras and TensorFlow patterns.
Kanban
A multi-project Kanban framework designed for AI agents to maintain persistent task states and deterministic board workflows.
JWT Authentication Security
A comprehensive technical skill for implementing and managing secure JSON Web Token (JWT) authentication workflows.
Korean Natural Language Writing
A specialized skill designed to bridge the gap between robotic AI-generated Korean and authentic, casual, human-sounding communication.
Landing Page
A structured framework for AI agents to generate high-converting landing pages with persuasive copy and optimized layout.
Featured*
