Skip to main content
ClawLink is designed so that provider credentials stay off your machine and out of your codebase. Hosted connection flows and tool execution happen in ClawLink’s infrastructure. OpenClaw keeps only the local ClawLink device credential it needs to authenticate to your account.

​
Credential storage

Most integrations connect through a hosted OAuth flow run by Composio, our credential infrastructure partner. Your provider OAuth tokens are vaulted by Composio — ClawLink stores only an opaque reference to your connected account, not the tokens themselves. Composio publishes its compliance posture at its trust center. When an integration uses a credential ClawLink holds directly — such as an API key you enter during setup — it is encrypted with AES-256-GCM before it is written to our database, never stored or logged in plaintext, and decrypted only in memory at the moment your request runs. Encryption keys can be rotated without downtime. ClawLink’s code is public on GitHub, including how credentials are encrypted and handled, so you or your security team can verify this directly. For the full picture of these boundaries, see the Security Overview.

​
Your machine stays clean

Because ClawLink proxies provider calls through its hosted infrastructure, you do not need to put third-party API keys in your .env files or source code for normal usage. Connect your apps once from the dashboard, and ClawLink handles the provider side.

​
OpenClaw authentication

The recommended setup is browser pairing. Pairing creates a local ClawLink credential in the format cllk_live_... and stores it in ~/.openclaw/openclaw.json for the OpenClaw plugin. This local credential authenticates OpenClaw to ClawLink. It is not a provider credential like your Google or Stripe token.
The locally stored ClawLink credential provides access to your connected apps through your account. Never share it or commit it to source control. If you believe it has been exposed, revoke it immediately in Settings > API Keys and pair again.

​
API key best practices

  • Prefer browser pairing over manual key entry
  • Use manually created keys only for advanced fallback setups or debugging
  • Use one key per device or workflow when you must create keys manually
  • Revoke old keys you no longer need instead of reusing them indefinitely

​
If your API key is compromised

If you suspect a ClawLink credential has been exposed or misused, act immediately:
1

Go to Settings > API Keys

Open the ClawLink dashboard and navigate to Settings > API Keys.
2

Generate a new key

Click Create API key if you need a replacement manual key.
3

Revoke the exposed key

Delete the old key so it cannot be used anymore.
4

Repeat setup on the affected device

If the exposed key came from browser pairing, run pairing again in OpenClaw. If it came from a manual plugin settings UI, paste the new raw key there.
Revoking a key invalidates it immediately. Any OpenClaw client still using that key will stop working until you pair again or update the manual settings field.

​
Transport security

All communication between your agent and ClawLink, and between ClawLink and third-party APIs, uses HTTPS. Credentials and request payloads are never transmitted over unencrypted connections.

​
Account security controls

Use Settings > Security to open the hosted account management screen for password, email, connected sign-in methods, and any additional protections your sign-in method supports.

​
Reporting security issues

Send security reports to [email protected]. Include reproduction steps, affected endpoints, and any relevant account or request context.