Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Spins up a temporary, one-time-use web UI for entering API keys and environment variables. The portal expires after a single submission and secrets never appear in terminal output or chat history. Supports cloudflared tunneling for secure remote access without firewall changes.
Pasting secrets into a terminal or chat leaves them in logs and history; this keeps values out of both by design.
When to use it
- Entering an API key on a remote server without it appearing in terminal history
- Letting a non-technical user submit credentials via their phone browser
- Collecting secrets from a contractor without sharing your terminal session
- Onboarding a new team member to enter their own credentials without shell access
- Adding env vars to a cloud instance without them showing up in shell logs
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Add my OPENAI_API_KEY to ~/.env without it showing up in the terminal
- 1Runs secret-portal with -k OPENAI_API_KEY, -f ~/.env, and --tunnel cloudflared
- 2Portal generates a one-time HTTPS URL containing a random 32-byte token
- 3User opens the URL in any browser and enters the key value into the input field
- 4Portal writes OPENAI_API_KEY to ~/.env with 600 permissions and shuts down
OPENAI_API_KEY written to ~/.env; portal expired and the URL is no longer valid
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.