Secret Manager

Secret Manager

A secure way to manage API keys for OpenClaw using the system keyring.

• macOS: Uses Keychain Access via security command
• Linux: Uses GNOME Keyring via secret-tool (libsecret)

This skill provides a secret-manager CLI that:

1. Stores API keys securely in the OS keyring.
2. Injects them into your auth-profiles.json.
3. (Linux only) Propagates them to systemd user environment.
4. (Linux only) Restarts the OpenClaw Gateway service inside your Distrobox container.

Installation

macOS (no extra dependencies)

macOS Keychain is built-in. No installation needed.

Linux

Ensure you have the dependencies:

• Debian/Ubuntu: sudo apt install libsecret-tools
• Fedora: sudo dnf install libsecret
• Arch: sudo pacman -S libsecret

Copy the script to your path or run it directly.

macOS Usage

# Store a key
security add-generic-password -a "openclaw" -s "OPENAI_API_KEY" -w "sk-xxx" -U

# Retrieve a key
security find-generic-password -a "openclaw" -s "OPENAI_API_KEY" -w

# Delete a key
security delete-generic-password -a "openclaw" -s "OPENAI_API_KEY"

# List all OpenClaw keys
security dump-keychain | grep -A5 "openclaw"

Configuration

The script uses default paths that work for most OpenClaw installations, but you can override them with environment variables:

Usage

List all configured keys:

secret-manager list

Set a key (interactive prompt):

secret-manager OPENAI_API_KEY
# (Paste key when prompted)

Set a key (direct):

secret-manager DISCORD_BOT_TOKEN "my-token-value"

Supported Keys:

• OPENAI_API_KEY
• GEMINI_API_KEY
• DISCORD_BOT_TOKEN
• GATEWAY_AUTH_TOKEN
• OLLAMA_API_KEY
• GIPHY_API_KEY
• GOOGLE_PLACES_API_KEY
• LINKEDIN_LI_AT
• LINKEDIN_JSESSIONID