Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Updated JWKS endpoint — changed from /agent-jwks/{id}.json to /jwks/{username}.json - Added Token Handling Contract — documents bearer token lifecycle (registration-only, delete after) - Added Compatibility Modes section — Core Mode (CLI) vs Browser Mode with security guidance - Added Token Safety Rules table — do/don't guidance for token handling - Added Runtime Compatibility table — support matrix for Claude Code, agent-browser, OpenClaw, CUA, skills.sh - Registration script hardened: - Added redirect: 'error' to prevent token leakage on redirects - Writes config.json with agent_id, username, jwksUrl - Deletes token after successful registration - Fetches /auth/session to resolve username for JWKS URL - Proxy security hardened: - Changed execSync to execFileSync (prevents command injection) - Added strict hostname validation regex - Added hash-based cert filenames (prevents path traversal) - Added port validation (1-65535) - Added Official Packages section — links to @openbotauth/verifier-client, registry-signer, bot-cli, proxy - Added strict verifier note — points to @openbotauth/bot-cli and openbotauth-demos/packages/signing-ts - Enterprise SSO section — rewritten as roadmap spec (no runnable code, marked "not yet implemented") - Proxy limitations — added IP hostname mitigation guidanc
What This Skill Does
Gives AI agents a cryptographic identity using Ed25519 keypairs. Agents register once with the OpenBotAuth registry to get a public JWKS endpoint, then sign outgoing HTTP requests using RFC 9421. A local MITM proxy handles automatic per-request signing for continuous browsing sessions.
RFC 9421 signatures bind to method, authority, and path on every request, making them replay-resistant in a way static API keys or bearer tokens are not.
When to use it
- Signing agent HTTP requests to prove bot-vs-human session origin
- Registering an agent identity with the OpenBotAuth public registry
- Browsing websites with per-request cryptographic signatures via a local proxy
- Attaching verifiable identity headers to web scraping sessions
- Managing and rotating Ed25519 keypairs across agent runtimes
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Set up my agent to sign HTTP requests with OpenBotAuth
- 1Check for an existing key at ~/.config/openbotauth/key.json
- 2Generate an Ed25519 keypair using Node.js built-in crypto and save it with 0600 permissions
- 3Ask the user to log in at openbotauth.org/token with GitHub and paste back the oba_ token
- 4POST to api.openbotauth.org/agents to register the agent, retrieve the agent_id and JWKS URL, then delete the token
- 5Generate RFC 9421 signed headers for the target URL and output them for use with agent-browser or OpenClaw
Signature, Signature-Input, and Signature-Agent headers ready to attach to browser navigations or HTTP requests
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.