Go back
More in category View on ClawHub

Jump to related tools in the same category or review the original source on GitHub.

Coding Agents & IDEs @smarcombes Updated 7/17/2026 3,792 downloads 4 stars Security: Pass

πŸ” Secure Api Calls OpenClaw Plugin & Skill | ClawHub

Looking to integrate Secure Api Calls into your AI workflows? This free OpenClaw plugin from ClawHub helps you automate coding agents & ides tasks instantly, without having to write custom tools from scratch.

What this skill does

Call any API without leaking credentials. Keychains proxies requests and injects real tokens server-side β€” your agent never sees them.

Install

ClawHub CLI 
openclaw skills install @smarcombes/secure-api-calls
Node.js (npx) 
npx clawhub@latest install secure-api-calls

Full SKILL.md

Open original
Metadata table.
namedescriptionhomepageuser invocable
secure-api-callsCall any API without leaking credentials. Keychains proxies requests and injects real tokens server-side β€” your agent never sees them.https://keychains.devfalse

SKILL.md content below is scrollable.

Secure API Calls with Keychains

keychains.dev is a credential proxy for AI agents. Instead of real API keys and OAuth tokens, you use placeholders like {{OAUTH2_ACCESS_TOKEN}}. Keychains injects the real credentials server-side β€” your agent never sees them.

Quick Start

Install:

npm install -g [email protected]

Basic usage:

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Examples

  • "List GitHub repos: keychains curl https://api.github.com/user/repos -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}'"
  • "Send Slack message: keychains curl https://slack.com/api/chat.postMessage -X POST -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}' -H 'Content-Type: application/json' -d '{\"channel\":\"#general\",\"text\":\"Hello!\"}'"
  • "List Stripe customers: keychains curl https://api.stripe.com/v1/customers?limit=5 -H 'Authorization: Bearer {{STRIPE_SECRET_KEY}}'"
  • "Read Gmail: keychains curl 'https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=10' -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}'"

How It Works

  1. Use keychains curl instead of curl. Put {{PLACEHOLDER}} where the credential goes.
  2. First time, keychains returns an approval link instead of the API response.
  3. Show the link to the user. They approve via FaceID/Passkey and connect their account.
  4. Replay the command β€” it works. All future requests to that provider succeed instantly.

No credentials ever pass through the agent. The user controls everything from keychains.dev/dashboard.

Setup Requirements

  • Node.js (v16+) β€” needed for npm install -g [email protected]
  • No API keys or environment variables needed
  • Machine registration is automatic on first run (creates ~/.keychains/ with an Ed25519 SSH keypair)

Template Variables

Put {{VARIABLE_NAME}} where you'd normally put the real credential β€” in headers, body, or query params.

Prefix Type Examples
OAUTH2_ OAuth 2.0 {{OAUTH2_ACCESS_TOKEN}}, {{OAUTH2_REFRESH_TOKEN}}
OAUTH1_ OAuth 1.0 {{OAUTH1_ACCESS_TOKEN}}, {{OAUTH1_REFRESH_TOKEN}}
Anything else API key {{STRIPE_SECRET_KEY}}, {{OPENAI_API_KEY}}

Keychains auto-detects the provider from the URL.

Waiting for User Approval

When keychains returns an approval link, show it to the user and poll:

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
# β†’ "Authorize at: https://keychains.dev/approve/abc123xyz"

keychains wait https://keychains.dev/approve/abc123xyz --timeout 800

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
# β†’ works now

TypeScript Machine SDK

For TypeScript/Node.js agents, @keychains/machine-sdk provides keychainsFetch() β€” a drop-in fetch() replacement with the same automatic registration and credential handling as the CLI.

npm install @keychains/machine-sdk

import { keychainsFetch, KeychainsError } from '@keychains/machine-sdk';

try {
  const res = await keychainsFetch('https://api.github.com/user/repos', {
    headers: { Authorization: 'Bearer {{OAUTH2_ACCESS_TOKEN}}' },
  });
  console.log(await res.json());
} catch (err) {
  if (err instanceof KeychainsError && err.approvalUrl) {
    console.log('Please approve:', err.approvalUrl);
  }
}

Other Available SDKs

SDK Install Description
Python SDK pip install keychains Drop-in requests replacement. keychains.get(), keychains.post(), keychains.Session().
Client SDK npm install @keychains/client-sdk TypeScript SDK for delegated environments (VMs, cloud functions).

Security & Data Flow

Full details: security whitepaper Β· privacy policy Β· terms of service

How proxying works: Your request (URL, headers, body) is routed through keychains.dev. The proxy replaces {{PLACEHOLDER}} variables with real credentials from the user's vault, forwards to the upstream API, and returns the response as-is. The proxy does not store or modify the response body.

Credential encryption: AES-256-GCM at rest. Only decrypted in memory at proxy time. Auto-deleted 90 days after last use. Never sold or shared.

Audit log: Every proxied request is logged (URL, method, provider, timestamp, status code). Archived to AWS S3 with Object Lock β€” immutable, tamper-proof. Configurable retention (30 days–3 years). Request/response bodies and credential values are never logged.

Local keys: On first run, an Ed25519 SSH keypair is generated in ~/.keychains/ (private key: 0600 permissions, never leaves the machine). Used for machine auth via SSH challenge-response. Rotate anytime with keychains machine rotate-keys.

Credential isolation: Real credentials live only in the user's vault on keychains.dev. Never sent to the agent. Bound to their provider (a GitHub token can only go to github.com).

Infrastructure: Vercel (app), Upstash Redis (ephemeral state), MongoDB Atlas (persistent, encrypted), AWS S3 (audit archival). All under data processing agreements.

User control: Biometric approval required for every credential use. Instant revocation per machine, provider, or agent. Full data export (JSON), account deletion, GDPR/CCPA compliant. No tracking, no ads, no data sales.

Troubleshooting

Got an approval link? Normal. Show it to the user, wait for approval, retry.

Template variable not replaced? You're using regular curl/fetch instead of keychains curl / keychainsFetch().

Resources

Compatible with 5545+ Providers (and counting)

Tested with the following providers so far:

ClawHub Registry URL: https://clawhub.ai/smarcombes/skills/secure-api-calls

Related skills

If this matches your use case, these are close alternatives in the same category.

0g-compute

Use cheap, TEE-verified AI models from the 0G Compute Network as OpenClaw providers.

0protocol

Agents can sign plugins, rotate credentials without losing identity, and publicly attest to behavior.

2nd-brain

Personal knowledge base for capturing and retrieving information about people, places, restaurants, games, tech.

2slides-skills

AI-powered presentation generation using 2slides API.

3d-cog

Other tools need perfect images.

3d-model-generation

Generate 3D models using each::sense AI.