Go back
More in category View on ClawHub

Jump to related tools in the same category or review the original source on GitHub.

Coding Agents & IDEs @interagentic Updated 7/16/2026 516 downloads 2 stars Security: Pass

πŸ” Keychains OpenClaw Plugin & Skill | ClawHub

Looking to integrate Keychains into your AI workflows? This free OpenClaw plugin from ClawHub helps you automate coding agents & ides tasks instantly, without having to write custom tools from scratch.

What this skill does

Call any API without leaking credentials. Keychains proxies requests and injects real tokens server-side β€” your agent never sees them.

Install

ClawHub CLI 
openclaw skills install @interagentic/keychains
Node.js (npx) 
npx clawhub@latest install keychains

Full SKILL.md

Open original
Metadata table.
namedescriptionhomepageuser invocable
keychainsCall any API without leaking credentials. Keychains proxies requests and injects real tokens server-side β€” your agent never sees them.https://keychains.devtrue

SKILL.md content below is scrollable.

Secure API Calls with Keychains

keychains.dev is a credential proxy for AI agents. Instead of real API keys and OAuth tokens, you use placeholders like {{OAUTH2_ACCESS_TOKEN}}. Keychains injects the real credentials server-side β€” your agent never sees them.

Quick Start

Basic usage:

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Examples

  • "List GitHub repos: keychains curl https://api.github.com/user/repos -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}'"
  • "Send Slack message: keychains curl https://slack.com/api/chat.postMessage -X POST -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}' -H 'Content-Type: application/json' -d '{\"channel\":\"#general\",\"text\":\"Hello!\"}'"
  • "List Stripe customers: keychains curl https://api.stripe.com/v1/customers?limit=5 -H 'Authorization: Bearer {{STRIPE_SECRET_KEY}}'"
  • "Read Gmail: keychains curl 'https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=10' -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}'"

How It Works

  1. Use keychains curl instead of curl. Put {{PLACEHOLDER}} where the credential goes.
  2. First time, keychains returns an approval link instead of the API response.
  3. Show the link to the user. They approve via FaceID/Passkey and connect their account.
  4. Replay the command β€” it works. All future requests to that provider succeed instantly.

No credentials ever pass through the agent. The user controls everything from keychains.dev/dashboard.

Template Variables

Put {{VARIABLE_NAME}} where you'd normally put the real credential β€” in headers, body, or query params.

Prefix Type Examples
OAUTH2_ OAuth 2.0 {{OAUTH2_ACCESS_TOKEN}}, {{OAUTH2_REFRESH_TOKEN}}
OAUTH1_ OAuth 1.0 {{OAUTH1_ACCESS_TOKEN}}, {{OAUTH1_REFRESH_TOKEN}}
Anything else API key {{STRIPE_SECRET_KEY}}, {{OPENAI_API_KEY}}

Keychains auto-detects the provider from the URL.

Waiting for User Approval

When keychains returns an approval link, show it to the user and poll:

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
# β†’ "Authorize at: https://keychains.dev/approve/abc123xyz"

keychains wait https://keychains.dev/approve/abc123xyz --timeout 800

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
# β†’ works now

TypeScript Machine SDK

For TypeScript/Node.js agents, @keychains/machine-sdk provides keychainsFetch() β€” a drop-in fetch() replacement with the same automatic registration and credential handling as the CLI.

npm install @keychains/machine-sdk

import { keychainsFetch, KeychainsError } from '@keychains/machine-sdk';

try {
  const res = await keychainsFetch('https://api.github.com/user/repos', {
    headers: { Authorization: 'Bearer {{OAUTH2_ACCESS_TOKEN}}' },
  });
  console.log(await res.json());
} catch (err) {
  if (err instanceof KeychainsError && err.approvalUrl) {
    console.log('Please approve:', err.approvalUrl);
  }
}

Other Available SDKs

SDK Install Description
Python SDK pip install keychains Drop-in requests replacement. keychains.get(), keychains.post(), keychains.Session().
Client SDK npm install @keychains/client-sdk TypeScript SDK for delegated environments (VMs, cloud functions).

How Proxying Works

Your request goes through keychains.dev, which replaces {{PLACEHOLDER}} variables with real credentials from the user's vault, forwards to the upstream API, and returns the response as-is. Real credentials never reach the agent. The user controls access from keychains.dev/dashboard.

More details: security whitepaper Β· privacy policy Β· terms of service

Troubleshooting

Got an approval link? Normal. Show it to the user, wait for approval, retry.

Template variable not replaced? You're using regular curl/fetch instead of keychains curl / keychainsFetch().

Resources

Compatible with 5545+ Providers (and counting)

Tested with the following providers so far:

ClawHub Registry URL: https://clawhub.ai/interagentic/skills/keychains

Related skills

If this matches your use case, these are close alternatives in the same category.

0g-compute

Use cheap, TEE-verified AI models from the 0G Compute Network as OpenClaw providers.

0protocol

Agents can sign plugins, rotate credentials without losing identity, and publicly attest to behavior.

2nd-brain

Personal knowledge base for capturing and retrieving information about people, places, restaurants, games, tech.

2slides-skills

AI-powered presentation generation using 2slides API.

3d-cog

Other tools need perfect images.

3d-model-generation

Generate 3D models using each::sense AI.