| name | secret-manager |
| description | Manage API keys securely via system keyring (macOS Keychain / GNOME Keyring) and inject them into OpenClaw config. |
| triggers | null |
| homepage | https://github.com/openclaw/skills |
| metadata | {"clawdbot":{"emoji":"🔐","requires":{"anyBins":["security","secret-tool"]},"install":[{"id":"bash","kind":"bash","bin":"secret-manager.sh","label":"Install Secret Manager (bash)"}]}} |
| version | 1.0.0 |
| status | stable |
| updated | "2026-03-11T00:00:00.000Z" |
| provides | ["secret-management","api-keys","security"] |
| os | ["darwin","linux","win32"] |
| clawdbot | {"emoji":"🔐","category":"tools","priority":"medium"} |
Secret Manager
A secure way to manage API keys for OpenClaw using the system keyring.
- macOS: Uses Keychain Access via
security command
- Linux: Uses GNOME Keyring via
secret-tool (libsecret)
This skill provides a secret-manager CLI that:
- Stores API keys securely in the OS keyring.
- Injects them into your
auth-profiles.json.
- (Linux only) Propagates them to
systemd user environment.
- (Linux only) Restarts the OpenClaw Gateway service inside your Distrobox container.
Installation
macOS (no extra dependencies)
macOS Keychain is built-in. No installation needed.
Linux
Ensure you have the dependencies:
- Debian/Ubuntu:
sudo apt install libsecret-tools
- Fedora:
sudo dnf install libsecret
- Arch:
sudo pacman -S libsecret
Copy the script to your path or run it directly.
macOS Usage
security add-generic-password -a "openclaw" -s "OPENAI_API_KEY" -w "sk-xxx" -U
security find-generic-password -a "openclaw" -s "OPENAI_API_KEY" -w
security delete-generic-password -a "openclaw" -s "OPENAI_API_KEY"
security dump-keychain | grep -A5 "openclaw"
Configuration
The script uses default paths that work for most OpenClaw installations, but you can override them with environment variables:
| Variable | Description | Default |
|---|
OPENCLAW_CONTAINER | Name of the Distrobox container (Linux only) | clawdbot |
OPENCLAW_HOME | Path to OpenClaw config directory | ~/.openclaw |
SECRETS_ENV_FILE | Path to an optional .env file to source | ~/.config/openclaw/secrets.env |
KEYRING_BACKEND | Force backend: keychain (macOS) or libsecret (Linux) | auto-detect |
Usage
List all configured keys:
secret-manager list
Set a key (interactive prompt):
secret-manager OPENAI_API_KEY
Set a key (direct):
secret-manager DISCORD_BOT_TOKEN "my-token-value"
Supported Keys:
OPENAI_API_KEY
GEMINI_API_KEY
DISCORD_BOT_TOKEN
GATEWAY_AUTH_TOKEN
OLLAMA_API_KEY
GIPHY_API_KEY
GOOGLE_PLACES_API_KEY
LINKEDIN_LI_AT
LINKEDIN_JSESSIONID