Credentials

Your master key is generated on your device and kept in your OS keychain — never sent to the server. Anything stored server-side is AES-256-GCM ciphertext, and the server has no key to decrypt it.

• Encrypt (write) — SDK loads your master key from the OS keychain, encrypts the credential (name, type, value, username, url all together) on your device, and uploads only the ciphertext.
• Decrypt (read) — SDK fetches the ciphertext, decrypts it locally with your master key, returns the plaintext. The server never sees plaintext.

Every credential gets a 12-hex short_id you reference in your agent code as clawise://<short_id>.

Set up the vault

clawise auth add

Paste an API key from the dashboard. The CLI generates a 32-byte master key on your device, stores it in your OS keychain (Keychain on macOS, Secret Service on Linux, Credential Manager on Windows) for everyday use, and writes a one-time credentials file:

master_key:    <base64 string>
recovery_code: clw-xxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxx

Save both lines to a password manager, then type I have saved at the prompt to delete the file. After deletion, the master key lives only in your keychain.

• master_key (base64) — load via CLAWISE_MASTER_KEY env var in environments without keychain access (CI, servers, Docker).
• recovery_code (clw-…) — paste during clawise auth add on another device to import this vault.

If you lose both backups and your keychain, the vault is unrecoverable — there is no server-side recovery.

The API key and the master key are a pair. Both are scoped to one Clawise org; you need both on any device — the API key to reach the server, the master key to decrypt anything it returns.

Manage credentials

import { Clawise } from "clawise";
const clawise = new Clawise({
  apiKey: "...",
  masterKey: Buffer.from(process.env.CLAWISE_MASTER_KEY!, "base64"),
});

const result = await clawise.vault.create({
  name: "openai-key",
  type: "api_key",
  value: "sk_live_...",
});
console.log(result.short_id);

const page = await clawise.vault.list();
const cred = await clawise.vault.get("crd_00000000-...");
await clawise.vault.delete("crd_00000000-...");

import base64, os
from clawise import Clawise

clawise = Clawise(
    api_key="...",
    master_key=base64.b64decode(os.environ["CLAWISE_MASTER_KEY"]),
)

result = clawise.vault.create(
    name="openai-key",
    type="api_key",
    value="sk_live_...",
)

page = clawise.vault.list()
cred = clawise.vault.get("crd_00000000-...")
clawise.vault.delete("crd_00000000-...")

client, _ := clawise.NewClient("...", clawise.WithMasterKey(masterKey))

result, _ := client.Vault.CreateCredential(ctx, clawise.CredentialPlaintext{
    Name:  "openai-key",
    Type:  "api_key",
    Value: "sk_live_...",
})

creds, _, _, _ := client.Vault.List(ctx, clawise.ListOpts{})
cred, _ := client.Vault.Get(ctx, "cred_01j9x...")
client.Vault.Delete(ctx, "cred_01j9x...")

clawise vault create --name openai-key --type api_key --value 'sk_live_...'
clawise vault list
clawise vault get cred_01j9x...
clawise vault delete cred_01j9x...

Use the placeholder in your agent's prompts and tool calls:

"Connect to OpenAI with API key clawise://a3f2b1d4e5c6"

The daemon proxy strips the real value out of your agent's outbound LLM traffic and substitutes the placeholder; on the way back, it restores plaintext.

Credentials are immutable. To update a secret, delete the old credential and add a new one.

Set up on another device

On the existing device, print the recovery code:

clawise vault recovery

On the new device:

clawise auth add

Paste the same API key. The CLI detects the vault is already initialized server-side and prompts for the recovery code. Once verified, all existing credentials become decryptable on the new device.

Rotate the master key

clawise vault rotate

Generates a new master key and a new recovery code. Existing credentials remain accessible from this device. The old recovery code is invalidated immediately — save the new one before doing anything else. Other devices will detect rotation on their next pull and prompt for re-authentication.

Reference

• Add credential
• List credentials
• Get credential
• Delete credential