Credential Manager

STATUS: MANDATORY SECURITY FOUNDATION

Consolidate scattered API keys and credentials into a secure, centralized .env file.

⚠️ This Is Not Optional

Centralized .env credential management is a core requirement for OpenClaw security. If your credentials are scattered across multiple files, stop and consolidate them now.

THE RULE: All credentials MUST be in ~/.openclaw/.env ONLY. No workspace, no skills, no scripts directories.

See:

• - CORE-PRINCIPLE.md - Why this is non-negotiable
• CONSOLIDATION-RULE.md - The single source principle

The Foundation

Every OpenClaw deployment MUST have:
CODEBLOCK0

This is your single source of truth for all credentials. No exceptions.

Why?

• - Single location = easier to secure
• File mode 600 = only you can read
• Git-ignored = won't accidentally commit
• Validated format = catches errors
• Audit trail = know what changed

Scattered credentials = scattered attack surface. This skill fixes that.

What This Skill Does

1. 1. Scans for credentials in common locations
2. Backs up existing credential files (timestamped)
3. Consolidates into INLINECODE3
4. Secures with proper permissions (600)
5. Validates security and format
6. Enforces best practices
7. Cleans up old files after migration

Detection Parameters

The skill automatically detects credentials by scanning for:

File Patterns:

• - credentials.json files in config directories
• INLINECODE5 files
• Memory files with -creds or credentials in the name

Sensitive Key Patterns:

• - API keys, access tokens, bearer tokens
• Secrets, passwords, passphrases
• OAuth consumer keys
• Private keys, signing keys, wallet keys
• Mnemonics and seed phrases

Security Checks:

• - File permissions (must be 600)
• Git-ignore protection
• Format validation

Quick Start

Full Migration (Recommended)

CODEBLOCK1

Individual Operations

CODEBLOCK2

Common Credential Locations

The skill scans these locations:

CODEBLOCK3

Security Features

✅ File permissions: Sets .env to mode 600 (owner only)
✅ Git protection: Creates/updates .gitignore
✅ Backups: Timestamped backups before changes
✅ Validation: Checks format, permissions, and duplicates
✅ Template: Creates .env.example (safe to share)

Output Structure

After migration:

CODEBLOCK4

Supported Services

Common services auto-detected:

• - X (Twitter): OAuth 1.0a credentials
• Molten: Agent intent matching
• Moltbook: Agent social network
• Botchan/4claw: Net Protocol
• OpenAI, Anthropic, Google: AI providers
• GitHub, GitLab: Code hosting
• Generic: API_KEY, *_TOKEN, *_SECRET patterns

See references/supported-services.md for full list.

Security Best Practices

See references/security.md for detailed security guidelines.

Quick checklist:

• - ✅ .env has 600 permissions
• ✅ .env is git-ignored
• ✅ No credentials in code or logs
• ✅ Rotate keys periodically
• ✅ Use separate keys per environment

Scripts

All scripts support --help for detailed usage.

scan.py

consolidate.py

validate.py

cleanup.py

Migration Workflow

Step 1: Discovery

./scripts/scan.py

Step 2: Backup & Consolidate

./scripts/consolidate.py

Step 3: Validation

./scripts/validate.py

Step 4: Test
Test your applications/skills with the new .env file.

Step 5: Cleanup

./scripts/cleanup.py --confirm

For Skill Developers: Enforce This Standard

Other OpenClaw skills MUST validate credentials are secure before using them:

Python Skills

Bash Skills

This creates a fail-fast system: If credentials aren't properly secured, skills refuse to run. Users are forced to fix it.

Loading Credentials

After migration, load from .env:

Python

Bash

Using Existing Loaders

Adding New Credentials

Edit ~/.openclaw/.env:
CODEBLOCK18

Update template too:
CODEBLOCK19

Rollback

If something goes wrong:

CODEBLOCK20

Notes

• - Non-destructive by default: Original files backed up before removal
• Idempotent: Safe to run multiple times
• Extensible: Add custom credential patterns in scripts
• Secure: Never logs full credentials, only metadata