The OpenClaw plugin for credential management

Why OpenClaw needs a credential layer

OpenClaw agents authenticate to the services they act on — GitHub, Slack, email, internal APIs, cloud accounts. The default setup is to paste those tokens into a config file or environment variable. That worked when one developer ran one agent locally. It does not scale.

In 2026, security researchers documented over 40,000 publicly exposed OpenClaw deployments leaking API keys, OAuth tokens, and cloud credentials in plaintext. The pattern is consistent: credentials are too broad, never rotated, and not tied to any identity that can be audited or revoked.

secr fixes the credential layer without changing how OpenClaw is run. You replace one config file with one SDK call. Everything else — the broker, the allowlist, the MCP gateway, the audit trail — runs server-side.

60-second install

The plugin registers before_tool_call, after_tool_call, and before_message_write hooks plus the secr.* tools automatically. No SDK glue code, no agent edits.

# One-line plugin install — no SDK glue code needed
openclaw plugins install npm:@secr/openclaw-plugin

# Or via ClawHub
openclaw plugins install clawhub:secr

# Set the agent token (from secr dashboard → Agents)
export SECR_AGENT_TOKEN=secr_agent_xxx

# Run any OpenClaw agent — secrets resolve at runtime,
# tool calls flow through the gateway, redaction is automatic.
openclaw run my-agent

Three hooks, full coverage

Advanced: programmatic broker

If you can't use the plugin (custom runtime, embedded), the @secr/openclaw SDK gives you the same broker as a library.

// Advanced: programmatic broker (when you don't want the plugin).
import { OpenClawSecretBroker, loadIdentity } from "@secr/openclaw";

const parsed = await loadIdentity("./IDENTITY.md");
const broker = OpenClawSecretBroker.fromIdentity(parsed);
await broker.materializeEnv();
// process.env now has only the keys the server allows for this agent.

IDENTITY.md is your binding

Add a secr: block to the IDENTITY.md frontmatter. The agent token never lives in the file — it's passed via SECR_AGENT_TOKEN env var or directly to the broker.

---
secr:
  org: acme
  project: support-bot
  environment: production
---

## Name
SupportBot

## Creature
AI Agent

## Vibe
Helpful and cautious

Everything secr does for OpenClaw

Every feature is server-enforced. The SDK is a thin wrapper — there's no client-side trust boundary.

Recommended reading

• Securing OpenClaw agents — what NHI means in practice
• Getting started with OpenClaw and secr
• OpenClaw secret allowlists — limit what each agent can read
• Human-in-the-loop tool approvals for OpenClaw
• Detecting shadow OpenClaw agents in your organisation
• The OpenClaw NHI posture checklist
• OpenClaw vs Claude Code — how NHI differs across AI agent frameworks
• Why plaintext .env files are failing OpenClaw