Your agents make API calls.
They should never see your keys.

Up and running in 60 seconds

Install, store your credentials once, and every agent you run is automatically protected.

$ npm install -g clauth-ai
$ clauth init
$ export CLAUTH_ADMIN_TOKEN='set-admin-token'
$ clauth daemon

$ export GITHUB_PAT='ghp_xxx'
$ export OPENAI_API_KEY='sk-xxx'
$ clauth store --handle github-main --provider github --secret-env GITHUB_PAT
$ clauth store --handle openai-main --provider openai --secret-env OPENAI_API_KEY

$ clauth grant --skill my-agent --provider github --scope github:read --rpm 60
$ clauth grant --skill my-agent --provider openai --scope openai:chat --rpm 60
$ clauth grant --skill my-agent --provider stripe --scope stripe:charges --rpm 30

Operator quick start

Copy/paste runbook to provision a skill and validate a real brokered call.

$ export CLAUTH_PASSPHRASE='your-long-passphrase-here'
$ export CLAUTH_ADMIN_TOKEN='set-admin-token'
$ clauth init
$ clauth daemon

# in another terminal
$ export CLAUTH_PASSPHRASE='your-long-passphrase-here'
$ export GITHUB_PAT='ghp_xxx'
$ clauth store --handle github-main --provider github --secret-env GITHUB_PAT
$ clauth grant --skill my-agent --provider github --scope github:read --rpm 60
$ clauth skill-token issue --skill my-agent
$ export CLAUTH_SKILL_TOKEN='<issued-token>'

$ curl -sS -X POST http://127.0.0.1:4317/clauth/v1/proxy \
  -H "content-type: application/json" \
  -H "x-clauth-skill-token: $CLAUTH_SKILL_TOKEN" \
  -d '{ "provider":"github","credentialHandle":"github-main","scope":"github:read","method":"GET","endpoint":"https://api.github.com/user" }'

$ curl -sS http://127.0.0.1:4317/clauth/v1/status

Expected: proxy returns a 200 wrapper with upstream payload; status shows auditIntegrity.valid true; audit log contains proxy.allow.

For skill developers

Your skill never sees a credential. Just tell Clauth what you need — it handles the rest.

import { ClauthClient } from "clauth-ai/client";

const clauth = new ClauthClient({
  skillId: "my-agent",
  skillToken: process.env.CLAUTH_SKILL_TOKEN
});

// Make an API call — Clauth injects credentials
const repos = await clauth.fetch(
  "github",
  "github-main",
  "github:read",
  "https://api.github.com/user/repos"
);

console.log(repos.body); // Your repos. No token in sight.

Built for trust

Clauth is designed so you don't have to trust Clauth. Everything is local, auditable, and under your control.

Under the hood

Explore the architecture, see a request flow in action, or compare the before and after.

If the interactive deep dive doesn't load, scripts may be blocked. The default view above is still accurate.

Documentation

Everything you need to get started, integrate your skills, and harden your setup.