Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Project config (.authy.toml), shell hook, alias generator, tightened agent skill scope
What This Skill Does
Authy injects secrets into subprocesses as environment variables without ever exposing their values. The `authy run` command passes credentials directly to child processes, keeping them out of shell history, logs, and script files. Secret names are discoverable via `authy list`; values are never returned to the caller.
Unlike exporting env vars manually or using .env files, secrets never appear in shell history, process listings, or on disk at any point.
When to use it
- Running a deploy script with production API keys
- Starting a backend server with database credentials
- Executing tests that require third-party service tokens
- Injecting cloud provider credentials into a CI build step
- Running a curl request with a bearer token from a secret store
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Run my deploy script using secrets from the 'deploy' scope
- 1Run `authy list --scope deploy --json` to discover available secret names
- 2Identify the secret names needed by the deploy script
- 3Construct the authy run command with --scope deploy --uppercase --replace-dash '_'
- 4Execute: `authy run --scope deploy --uppercase --replace-dash '_' -- ./deploy.sh`
- 5Confirm exit code 0 indicating successful secret injection and script execution
deploy.sh runs with secrets like DB_HOST and API_KEY injected as environment variables, values never visible in the shell or logs
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.