Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
v3: Vault key selector for skills, manual +Add Secret form, vault-only keys section, restart notification banner, skills expanded by default, inline key creation from skills tab, vaultKeyId on SkillStatusEntry, envEntry param on secrets.write
What This Skill Does
Vault-backed API key management UI for OpenClaw. Stores secrets in ~/.openclaw/secrets.json (mode 0600) and replaces plaintext config values with SecretRef objects. The AI agent never receives raw key values.
Keys are resolved at gateway startup and never passed to the agent, unlike plaintext env vars that are visible throughout the runtime config.
When to use it
- Migrating plaintext API keys from openclaw.json to the secure vault in one click
- Adding a new provider key without manually editing config files
- Linking a skill to a vault key via dropdown instead of pasting raw strings
- Checking which keys are plaintext vs vault-secured at a glance
- Creating standalone vault secrets not tied to any config entry
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: migrate my plaintext OpenAI key to the vault
- 1UI scans openclaw.json and detects OPENAI_API_KEY stored as plaintext
- 2Vault Status Banner shows warning: 1 Plaintext Key Detected
- 3User clicks Migrate to Vault button
- 4secrets.migrate RPC writes key to ~/.openclaw/secrets.json and replaces config value with a SecretRef object
- 5UI shows restart notification banner; user clicks Restart Now
OPENAI_API_KEY shows VAULT badge; openclaw.json contains SecretRef instead of raw key string