clawauth

# Clawauth OAuth Skill

This skill gives agents a production-safe OAuth handover flow that is async by default and works across chat/session interruptions.

Use this when the agent needs provider credentials from a human user, but must avoid blocking execution and must avoid long-lived token storage on a third-party auth SaaS.

## Why this exists

Most "OAuth gateway" patterns keep user refresh tokens in a central hosted database. clawauth avoids that model:

- Hosted edge service mints short-lived auth sessions.
- User authorizes directly with the provider.
- Token response is encrypted end-to-end to the requesting CLI session.
- CLI claims once and stores token locally in system keychain.
- Server-side session is ephemeral and deleted on claim/expiry.

Result: async UX for agents, minimal operator overhead, and no permanent central token vault by design.

## Runtime prerequisite

`clawauth` must already be preinstalled in the trusted runtime image/environment by the operator.
This skill does not instruct dynamic package installation.

OpenClaw can detect this requirement from frontmatter metadata:

- `metadata.openclaw.requires.bins: ["clawauth"]` gates eligibility.
- `metadata.openclaw.install` can expose an operator-approved install action in OpenClaw UI/Gateway flows.

## How installation is documented and triggered

- Installation intent is declared in frontmatter, not in free-form shell instructions.
- This skill declares a Node installer in `metadata.openclaw.install` for package `clawauth`.
- OpenClaw/Gateway uses that metadata to offer a managed install action when `clawauth` is missing.
- If multiple installer options are present, Gateway selects a preferred one (OpenClaw docs: brew preferred when available, otherwise node manager policy).
- For this skill we publish a single Node installer path to keep behavior deterministic across hosts.
- Reference: https://docs.openclaw.ai/tools/skills
- Reference: https://docs.openclaw.ai/platforms/mac/skills
- Sourc...