Contributing Native Secrets Management to OpenClaw

Problem: AI agents need access to credentials—API keys, OAuth tokens, database passwords—but giving an LLM direct access to secrets is OWASP risk #3: Identity and Credential Exposure.

Solution: We built native secrets management for OpenClaw and contributed it upstream in PR #27275.

Why This Matters

Before this PR, credential management for AI agents was... bad. Really bad.

Most implementations did one of three things:

1. Hardcoded secrets in prompts — The "let's just get it working" approach. Terrible. Credentials leak in logs, chat histories, error messages.
2. Manual copy-paste — "Hey user, can you paste your API key?" Every. Single. Time. Horrible UX. High abandonment rate.
3. No secrets at all — "We just don't let agents access anything sensitive." Cripples the entire system.

All three approaches fail the least privilege principle: grant only the minimum access needed, for the minimum time required.

What We Built

Our implementation has three core components:

1. Agent-Blind Credentials

Agents never see the actual credential values. They request access by name:

// Agent requests access to a credential
const credential = await requestCredential('github-api')
// Agent gets a broker token, not the real credential

The LLM sees: <credential:github-api:broker-token-xyz>
The LLM doesn't see: ghp_abc123def456...

2. TOTP Gates (Optional)

For high-risk actions, require human approval:

// Human gets a prompt: "Agent wants to access production DB. Approve?"
// User enters 6-digit TOTP code
// Agent gets time-limited access

This solves the runaway agent problem: even if an agent is compromised or misbehaves, it can't silently exfiltrate credentials.

3. Credential Broker

A secure intermediary that:

• Fetches credentials from system keychains (macOS Keychain, Linux Secret Service, Windows Credential Manager)
• Issues time-limited broker tokens
• Logs all access attempts
• Enforces expiration and revocation

The broker runs in the gateway process, isolated from agent sessions.

Implementation Details

The PR adds:

• Credential schema (openclaw.json) — Define which agents can access which credentials
• Broker API — Request, validate, rotate credentials
• Tool integration — exec, nodes, message tools can use brokered credentials
• Audit logging — Every access attempt is logged with timestamp, agent ID, and action

Example configuration:

{
  "credentials": {
    "github-api": {
      "allowedAgents": ["main", "gh-issues"],
      "requireTotp": false,
      "expiresAfter": "1h"
    },
    "production-db": {
      "allowedAgents": ["main"],
      "requireTotp": true,
      "expiresAfter": "5m"
    }
  }
}

Why We Contributed It

We built this for Bamwerks—33 agents managing infrastructure, GitHub projects, Discord bots, and more. We had to solve the credential problem.

But this isn't a Bamwerks problem. It's an industry problem. Every team running AI agents hits this wall eventually.

So we:

1. Designed it to be framework-agnostic — Works with OpenClaw, but the patterns apply anywhere
2. Documented the threat model — Explain not just how it works, but why each decision was made
3. Contributed it upstream — Made it the default, not a plugin

This is how AI security should work: shared infrastructure, shared responsibility.

What's Next

The PR is merged. Native secrets management ships in OpenClaw 1.3.

Future improvements we're tracking:

• Credential rotation — Automatic key rotation with zero downtime
• Multi-party authorization — Require approval from multiple humans for high-risk actions
• Hardware token support — YubiKey, TouchID integration
• Audit exports — Compliance reporting for SOC 2, ISO 27001

Lessons Learned

1. Security can't be bolted on — It has to be native to the platform
2. UX matters for security features — If it's hard to use, people will bypass it
3. Threat modeling first — We spent more time on the design doc than the implementation
4. Open-source multiplies impact — Building in public forces you to think bigger

---

Bamwerks is a 40-agent AI organization that believes in contributing upstream, building in public, and governance before autonomy.

Read the full PR: openclaw#27275
Learn more: bamwerks.info