Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
API key mode: one key for all credentials via X-Credential-Name header. Per-credential proxy tokens (AGENTKEYS_PROXY_TOKEN_STRIPE). Python tab. Credential editing.
What This Skill Does
AgentKeys is a credential proxy for AI agents. API calls route through the proxy, which injects real secrets server-side before forwarding to the target. The agent never handles plaintext API keys, tokens, or passwords.
Decoupling secrets from agents means revoking access or rotating keys requires no changes to agent code.
When to use it
- Sending emails via Resend without embedding the API key in an agent
- Revoking a compromised agent's API access without rotating the underlying credential
- Auditing which agent made calls to a third-party service and when
- Sharing one credential across multiple agents without duplicating secrets
- Rotating API keys without redeploying or reconfiguring agents
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Send a transactional email via Resend without giving the agent direct API access
- 1Reads AGENTKEYS_PROXY_URL and AGENTKEYS_API_KEY from environment
- 2Sends POST to the proxy endpoint with X-Credential-Name: resend and X-Target-Url pointing to the Resend API
- 3AgentKeys decrypts the real Resend credential server-side
- 4Proxy injects the credential into headers and forwards the request to Resend
- 5Returns the API response and logs the call in the audit trail
Email sent via Resend; the real API key was never exposed to the agent
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.