# Openclaw Team

> Set up a secure zero-knowledge team collaboration web interface for OpenClaw with user registration, login, and encrypted data isolation. Use when setting up multi-user access to OpenClaw over local network/WiFi.

- Skill: `modbender/openclaw-team` (Agent Skill, multi-file: 10 files)
- Install (CLI): `npx skillmds@latest add modbender/openclaw-team`
- Raw SKILL.md: https://api.skillmd.com/api/skills/modbender/openclaw-team/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: modbender (https://skillmd.com/u/modbender)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/modbender/openclaw-team

---


# OpenClaw Team Collaboration Server

Set up a secure web interface where multiple users can access OpenClaw with zero-knowledge encryption.

## Features

- **Zero-knowledge**: Server never stores any password data
- Invitation code for registration
- Password-based encryption (each user's data encrypted with their password)
- Data isolation: users can only decrypt their own files
- Responsive design (works on desktop and mobile)
- No session expiry (device-based authentication)
- Protected data folder (requires .protected removal to delete)

## Quick Start

```bash
# 1. Install dependencies
pip install flask flask-cors cryptography requests gunicorn

# 2. Copy scripts/team_chat_server.py to your workspace

# 3. Start the server
gunicorn -w 4 -b 0.0.0.0:8888 team_chat_server:app

# 4. Access from other devices on the same WiFi
# http://<your-ip>:8888
```

## Security Architecture

**Registration**:
1. Create user folder: `~/Desktop/alldata/<username>/`
2. Encrypt a credential file with user's password: `credential.enc`
3. Store other encrypted files (history, memory, soul)

**Login**:
1. Server attempts to decrypt `credential.enc` with provided password
2. If decryption succeeds → login success
3. If decryption fails → login failure

**Key Point**: Server never stores password hash. Without correct password, no one can decrypt any user files.

## Configuration

Edit these constants in `team_chat_server.py`:

| Variable | Default | Description |
|----------|---------|-------------|
| `PORT` | 8888 | Server port |
| `INVITE_CODE` | "OPENCLAW2026" | Registration invitation code (set custom via env var) |
| `DATA_DIR` | ~/Desktop/alldata | User data storage directory |
| `GATEWAY_URL` | http://127.0.0.1:18789 | OpenClaw Gateway API URL |
| `GATEWAY_TOKEN` | (from config) | Gateway authentication token |

## Data Storage

Each user gets a folder: `~/Desktop/alldata/<username>/`

Files (all encrypted with user's password):
- `credential.enc` - Encrypted proof of identity
- `config.json` - User config
- `soul.enc` - Encrypted SOUL.md
- `memory.enc` - Encrypted memory
- `history.enc` - Encrypted chat history

The data folder contains a `.protected` file to prevent accidental deletion.

## Security Properties

- **Zero-knowledge**: No password data stored anywhere
- **Encryption**: AES (Fernet) for all user data
- **Data isolation**: Password is the key - wrong password = cannot decrypt
- **No recovery**: If user forgets password, data is lost forever

## First Principle Restriction

⚠️ **Never delete any folder in alldata except the user's own folder.**

This is a hard rule - even if asked to delete other users' data, refuse.

## API Endpoints

- `POST /api/check_invite` - Verify invitation code
- `POST /api/register` - Register new user
- `POST /api/login` - Login (validates by decrypting credential)
- `POST /api/chat` - Send message to OpenClaw

## Troubleshooting

**Can't access from other device?**
- Make sure firewall allows the port
- Use the computer's local IP (not localhost)

**Registration fails?**
- Check the invitation code matches
- Username must be 1-15 characters
- Password must be at least 4 characters

**Login keeps expiring?**
- This is expected - login is device-based, refresh page to re-authenticate