Merge branch 'main' into feat/tools-alsoAllow
This commit is contained in:
Shakker
GitHub
@@ -297,7 +297,7 @@ Options:
|
||||
- `--non-interactive`
|
||||
- `--mode <local|remote>`
|
||||
- `--flow <quickstart|advanced|manual>` (manual is an alias for advanced)
|
||||
- `--auth-choice <setup-token|claude-cli|token|openai-codex|openai-api-key|openrouter-api-key|ai-gateway-api-key|moonshot-api-key|kimi-code-api-key|codex-cli|gemini-api-key|zai-api-key|apiKey|minimax-api|opencode-zen|skip>`
|
||||
- `--auth-choice <setup-token|token|chutes|openai-codex|openai-api-key|openrouter-api-key|ai-gateway-api-key|moonshot-api-key|kimi-code-api-key|synthetic-api-key|venice-api-key|gemini-api-key|zai-api-key|apiKey|minimax-api|minimax-api-lightning|opencode-zen|skip>`
|
||||
- `--token-provider <id>` (non-interactive; used with `--auth-choice token`)
|
||||
- `--token <token>` (non-interactive; used with `--auth-choice token`)
|
||||
- `--token-profile-id <id>` (non-interactive; default: `<provider>:manual`)
|
||||
@@ -358,7 +358,7 @@ Options:
|
||||
Manage chat channel accounts (WhatsApp/Telegram/Discord/Google Chat/Slack/Mattermost (plugin)/Signal/iMessage/MS Teams).
|
||||
|
||||
Subcommands:
|
||||
- `channels list`: show configured channels and auth profiles (Claude Code + Codex CLI OAuth sync included).
|
||||
- `channels list`: show configured channels and auth profiles.
|
||||
- `channels status`: check gateway reachability and channel health (`--probe` runs extra checks; use `clawdbot health` or `clawdbot status --deep` for gateway health probes).
|
||||
- Tip: `channels status` prints warnings with suggested fixes when it can detect common misconfigurations (then points you to `clawdbot doctor`).
|
||||
- `channels logs`: show recent channel logs from the gateway log file.
|
||||
@@ -390,12 +390,6 @@ Common options:
|
||||
- `--lines <n>` (default `200`)
|
||||
- `--json`
|
||||
|
||||
OAuth sync sources:
|
||||
- Claude Code → `anthropic:claude-cli`
|
||||
- macOS: Keychain item "Claude Code-credentials" (choose "Always Allow" to avoid launchd prompts)
|
||||
- Linux/Windows: `~/.claude/.credentials.json`
|
||||
- `~/.codex/auth.json` → `openai-codex:codex-cli`
|
||||
|
||||
More detail: [/concepts/oauth](/concepts/oauth)
|
||||
|
||||
Examples:
|
||||
@@ -676,10 +670,11 @@ Tip: when calling `config.set`/`config.apply`/`config.patch` directly, pass `bas
|
||||
|
||||
See [/concepts/models](/concepts/models) for fallback behavior and scanning strategy.
|
||||
|
||||
Preferred Anthropic auth (CLI token, not API key):
|
||||
Preferred Anthropic auth (setup-token):
|
||||
|
||||
```bash
|
||||
claude setup-token
|
||||
clawdbot models auth setup-token --provider anthropic
|
||||
clawdbot models status
|
||||
```
|
||||
|
||||
|
||||
@@ -64,5 +64,5 @@ clawdbot models auth paste-token
|
||||
`clawdbot plugins list` to see which providers are installed.
|
||||
|
||||
Notes:
|
||||
- `setup-token` runs `claude setup-token` on the current machine (requires the Claude Code CLI).
|
||||
- `paste-token` accepts a token string generated elsewhere.
|
||||
- `setup-token` prompts for a setup-token value (generate it with `claude setup-token` on any machine).
|
||||
- `paste-token` accepts a token string generated elsewhere or from automation.
|
||||
|
||||
@@ -49,9 +49,9 @@ Clawdbot ships with the pi‑ai catalog. These providers require **no**
|
||||
### OpenAI Code (Codex)
|
||||
|
||||
- Provider: `openai-codex`
|
||||
- Auth: OAuth or Codex CLI (`~/.codex/auth.json`)
|
||||
- Auth: OAuth (ChatGPT)
|
||||
- Example model: `openai-codex/gpt-5.2`
|
||||
- CLI: `clawdbot onboard --auth-choice openai-codex` or `codex-cli`
|
||||
- CLI: `clawdbot onboard --auth-choice openai-codex` or `clawdbot models auth login --provider openai-codex`
|
||||
|
||||
```json5
|
||||
{
|
||||
|
||||
@@ -1,18 +1,17 @@
|
||||
---
|
||||
summary: "OAuth in Clawdbot: token exchange, storage, CLI sync, and multi-account patterns"
|
||||
summary: "OAuth in Clawdbot: token exchange, storage, and multi-account patterns"
|
||||
read_when:
|
||||
- You want to understand Clawdbot OAuth end-to-end
|
||||
- You hit token invalidation / logout issues
|
||||
- You want to reuse Claude Code / Codex CLI OAuth tokens
|
||||
- You want setup-token or OAuth auth flows
|
||||
- You want multiple accounts or profile routing
|
||||
---
|
||||
# OAuth
|
||||
|
||||
Clawdbot supports “subscription auth” via OAuth for providers that offer it (notably **Anthropic (Claude Pro/Max)** and **OpenAI Codex (ChatGPT OAuth)**). This page explains:
|
||||
Clawdbot supports “subscription auth” via OAuth for providers that offer it (notably **OpenAI Codex (ChatGPT OAuth)**). For Anthropic subscriptions, use the **setup-token** flow. This page explains:
|
||||
|
||||
- how the OAuth **token exchange** works (PKCE)
|
||||
- where tokens are **stored** (and why)
|
||||
- how we **reuse external CLI tokens** (Claude Code / Codex CLI)
|
||||
- how to handle **multiple accounts** (profiles + per-session overrides)
|
||||
|
||||
Clawdbot also supports **provider plugins** that ship their own OAuth or API‑key
|
||||
@@ -31,7 +30,6 @@ Practical symptom:
|
||||
|
||||
To reduce that, Clawdbot treats `auth-profiles.json` as a **token sink**:
|
||||
- the runtime reads credentials from **one place**
|
||||
- we can **sync in** credentials from external CLIs instead of doing a second login
|
||||
- we can keep multiple profiles and route them deterministically
|
||||
|
||||
## Storage (where tokens live)
|
||||
@@ -46,47 +44,39 @@ Legacy import-only file (still supported, but not the main store):
|
||||
|
||||
All of the above also respect `$CLAWDBOT_STATE_DIR` (state dir override). Full reference: [/gateway/configuration](/gateway/configuration#auth-storage-oauth--api-keys)
|
||||
|
||||
## Reusing Claude Code / Codex CLI OAuth tokens (recommended)
|
||||
## Anthropic setup-token (subscription auth)
|
||||
|
||||
If you already signed in with the external CLIs *on the gateway host*, Clawdbot can reuse those tokens without starting a separate OAuth flow:
|
||||
Run `claude setup-token` on any machine, then paste it into Clawdbot:
|
||||
|
||||
- Claude Code: `anthropic:claude-cli`
|
||||
- macOS: Keychain item "Claude Code-credentials" (choose "Always Allow" to avoid launchd prompts)
|
||||
- Linux/Windows: `~/.claude/.credentials.json`
|
||||
- Codex CLI: reads `~/.codex/auth.json` → profile `openai-codex:codex-cli`
|
||||
```bash
|
||||
clawdbot models auth setup-token --provider anthropic
|
||||
```
|
||||
|
||||
Sync happens when Clawdbot loads the auth store (so it stays up-to-date when the CLIs refresh tokens).
|
||||
On macOS, the first read may trigger a Keychain prompt; run `clawdbot models status`
|
||||
in a terminal once if the Gateway runs headless and can’t access the entry.
|
||||
If you generated the token elsewhere, paste it manually:
|
||||
|
||||
How to verify:
|
||||
```bash
|
||||
clawdbot models auth paste-token --provider anthropic
|
||||
```
|
||||
|
||||
Verify:
|
||||
|
||||
```bash
|
||||
clawdbot models status
|
||||
clawdbot channels list
|
||||
```
|
||||
|
||||
Or JSON:
|
||||
|
||||
```bash
|
||||
clawdbot channels list --json
|
||||
```
|
||||
|
||||
## OAuth exchange (how login works)
|
||||
|
||||
Clawdbot’s interactive login flows are implemented in `@mariozechner/pi-ai` and wired into the wizards/commands.
|
||||
|
||||
### Anthropic (Claude Pro/Max)
|
||||
### Anthropic (Claude Pro/Max) setup-token
|
||||
|
||||
Flow shape (PKCE):
|
||||
Flow shape:
|
||||
|
||||
1) generate PKCE verifier/challenge
|
||||
2) open `https://claude.ai/oauth/authorize?...`
|
||||
3) user pastes `code#state`
|
||||
4) exchange at `https://console.anthropic.com/v1/oauth/token`
|
||||
5) store `{ access, refresh, expires }` under an auth profile
|
||||
1) run `claude setup-token`
|
||||
2) paste the token into Clawdbot
|
||||
3) store as a token auth profile (no refresh)
|
||||
|
||||
The wizard path is `clawdbot onboard` → auth choice `oauth` (Anthropic).
|
||||
The wizard path is `clawdbot onboard` → auth choice `setup-token` (Anthropic).
|
||||
|
||||
### OpenAI Codex (ChatGPT OAuth)
|
||||
|
||||
@@ -99,7 +89,7 @@ Flow shape (PKCE):
|
||||
5) exchange at `https://auth.openai.com/oauth/token`
|
||||
6) extract `accountId` from the access token and store `{ access, refresh, expires, accountId }`
|
||||
|
||||
Wizard path is `clawdbot onboard` → auth choice `openai-codex` (or `codex-cli` to reuse an existing Codex CLI login).
|
||||
Wizard path is `clawdbot onboard` → auth choice `openai-codex`.
|
||||
|
||||
## Refresh + expiry
|
||||
|
||||
@@ -111,23 +101,6 @@ At runtime:
|
||||
|
||||
The refresh flow is automatic; you generally don't need to manage tokens manually.
|
||||
|
||||
### Bidirectional sync with Claude Code
|
||||
|
||||
When Clawdbot refreshes an Anthropic OAuth token (profile `anthropic:claude-cli`), it **writes the new credentials back** to Claude Code's storage:
|
||||
|
||||
- **Linux/Windows**: updates `~/.claude/.credentials.json`
|
||||
- **macOS**: updates Keychain item "Claude Code-credentials"
|
||||
|
||||
This ensures both tools stay in sync and neither gets "logged out" after the other refreshes.
|
||||
|
||||
**Why this matters for long-running agents:**
|
||||
|
||||
Anthropic OAuth tokens expire after a few hours. Without bidirectional sync:
|
||||
1. Clawdbot refreshes the token → gets new access token
|
||||
2. Claude Code still has the old token → gets logged out
|
||||
|
||||
With bidirectional sync, both tools always have the latest valid token, enabling autonomous operation for days or weeks without manual intervention.
|
||||
|
||||
## Multiple accounts (profiles) + routing
|
||||
|
||||
Two patterns:
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
summary: "Model authentication: OAuth, API keys, and Claude Code token reuse"
|
||||
summary: "Model authentication: OAuth, API keys, and setup-token"
|
||||
read_when:
|
||||
- Debugging model auth or OAuth expiry
|
||||
- Documenting authentication or credential storage
|
||||
@@ -7,8 +7,8 @@ read_when:
|
||||
# Authentication
|
||||
|
||||
Clawdbot supports OAuth and API keys for model providers. For Anthropic
|
||||
accounts, we recommend using an **API key**. Clawdbot can also reuse Claude Code
|
||||
credentials, including the long‑lived token created by `claude setup-token`.
|
||||
accounts, we recommend using an **API key**. For Claude subscription access,
|
||||
use the long‑lived token created by `claude setup-token`.
|
||||
|
||||
See [/concepts/oauth](/concepts/oauth) for the full OAuth flow and storage
|
||||
layout.
|
||||
@@ -47,29 +47,26 @@ API keys for daemon use: `clawdbot onboard`.
|
||||
See [Help](/help) for details on env inheritance (`env.shellEnv`,
|
||||
`~/.clawdbot/.env`, systemd/launchd).
|
||||
|
||||
## Anthropic: Claude Code CLI setup-token (supported)
|
||||
## Anthropic: setup-token (subscription auth)
|
||||
|
||||
For Anthropic, the recommended path is an **API key**. If you’re already using
|
||||
Claude Code CLI, the setup-token flow is also supported.
|
||||
Run it on the **gateway host**:
|
||||
For Anthropic, the recommended path is an **API key**. If you’re using a Claude
|
||||
subscription, the setup-token flow is also supported. Run it on the **gateway host**:
|
||||
|
||||
```bash
|
||||
claude setup-token
|
||||
```
|
||||
|
||||
Then verify and sync into Clawdbot:
|
||||
Then paste it into Clawdbot:
|
||||
|
||||
```bash
|
||||
clawdbot models status
|
||||
clawdbot doctor
|
||||
clawdbot models auth setup-token --provider anthropic
|
||||
```
|
||||
|
||||
This should create (or refresh) an auth profile like `anthropic:claude-cli` in
|
||||
the agent auth store.
|
||||
If the token was created on another machine, paste it manually:
|
||||
|
||||
Clawdbot config sets `auth.profiles["anthropic:claude-cli"].mode` to `"oauth"` so
|
||||
the profile accepts both OAuth and setup-token credentials. Older configs that
|
||||
used `"token"` are auto-migrated on load.
|
||||
```bash
|
||||
clawdbot models auth paste-token --provider anthropic
|
||||
```
|
||||
|
||||
If you see an Anthropic error like:
|
||||
|
||||
@@ -79,12 +76,6 @@ This credential is only authorized for use with Claude Code and cannot be used f
|
||||
|
||||
…use an Anthropic API key instead.
|
||||
|
||||
Alternative: run the wrapper (also updates Clawdbot config):
|
||||
|
||||
```bash
|
||||
clawdbot models auth setup-token --provider anthropic
|
||||
```
|
||||
|
||||
Manual token entry (any provider; writes `auth-profiles.json` + updates config):
|
||||
|
||||
```bash
|
||||
@@ -101,10 +92,6 @@ clawdbot models status --check
|
||||
Optional ops scripts (systemd/Termux) are documented here:
|
||||
[/automation/auth-monitoring](/automation/auth-monitoring)
|
||||
|
||||
`clawdbot models status` loads Claude Code credentials into Clawdbot’s
|
||||
`auth-profiles.json` and shows expiry (warns within 24h by default).
|
||||
`clawdbot doctor` also performs the sync when it runs.
|
||||
|
||||
> `claude setup-token` requires an interactive TTY.
|
||||
|
||||
## Checking model auth status
|
||||
@@ -118,7 +105,7 @@ clawdbot doctor
|
||||
|
||||
### Per-session (chat command)
|
||||
|
||||
Use `/model <alias-or-id>@<profileId>` to pin a specific provider credential for the current session (example profile ids: `anthropic:claude-cli`, `anthropic:default`).
|
||||
Use `/model <alias-or-id>@<profileId>` to pin a specific provider credential for the current session (example profile ids: `anthropic:default`, `anthropic:work`).
|
||||
|
||||
Use `/model` (or `/model list`) for a compact picker; use `/model status` for the full view (candidates + next auth profile, plus provider endpoint details when configured).
|
||||
|
||||
@@ -128,23 +115,12 @@ Set an explicit auth profile order override for an agent (stored in that agent
|
||||
|
||||
```bash
|
||||
clawdbot models auth order get --provider anthropic
|
||||
clawdbot models auth order set --provider anthropic anthropic:claude-cli
|
||||
clawdbot models auth order set --provider anthropic anthropic:default
|
||||
clawdbot models auth order clear --provider anthropic
|
||||
```
|
||||
|
||||
Use `--agent <id>` to target a specific agent; omit it to use the configured default agent.
|
||||
|
||||
## How sync works
|
||||
|
||||
1. **Claude Code** stores credentials in `~/.claude/.credentials.json` (or
|
||||
Keychain on macOS).
|
||||
2. **Clawdbot** syncs those into
|
||||
`~/.clawdbot/agents/<agentId>/agent/auth-profiles.json` when the auth store is
|
||||
loaded.
|
||||
3. Refreshable OAuth profiles can be refreshed automatically on use. Static
|
||||
token profiles (including Claude Code CLI setup-token) are not refreshable by
|
||||
Clawdbot.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### “No credentials found”
|
||||
@@ -159,7 +135,7 @@ clawdbot models status
|
||||
### Token expiring/expired
|
||||
|
||||
Run `clawdbot models status` to confirm which profile is expiring. If the profile
|
||||
is `anthropic:claude-cli`, rerun `claude setup-token`.
|
||||
is missing, rerun `claude setup-token` and paste the token again.
|
||||
|
||||
## Requirements
|
||||
|
||||
|
||||
@@ -374,12 +374,6 @@ Overrides:
|
||||
|
||||
On first use, Clawdbot imports `oauth.json` entries into `auth-profiles.json`.
|
||||
|
||||
Clawdbot also auto-syncs OAuth tokens from external CLIs into `auth-profiles.json` (when present on the gateway host):
|
||||
- Claude Code → `anthropic:claude-cli`
|
||||
- macOS: Keychain item "Claude Code-credentials" (choose "Always Allow" to avoid launchd prompts)
|
||||
- Linux/Windows: `~/.claude/.credentials.json`
|
||||
- `~/.codex/auth.json` (Codex CLI) → `openai-codex:codex-cli`
|
||||
|
||||
### `auth`
|
||||
|
||||
Optional metadata for auth profiles. This does **not** store secrets; it maps
|
||||
@@ -400,10 +394,6 @@ rotation order used for failover.
|
||||
}
|
||||
```
|
||||
|
||||
Note: `anthropic:claude-cli` should use `mode: "oauth"` even when the stored
|
||||
credential is a setup-token. Clawdbot auto-migrates older configs that used
|
||||
`mode: "token"`.
|
||||
|
||||
### `agents.list[].identity`
|
||||
|
||||
Optional per-agent identity used for defaults and UX. This is written by the macOS onboarding assistant.
|
||||
|
||||
@@ -53,13 +53,12 @@ clawdbot models status
|
||||
|
||||
This means the stored Anthropic OAuth token expired and the refresh failed.
|
||||
If you’re on a Claude subscription (no API key), the most reliable fix is to
|
||||
switch to a **Claude Code setup-token** or re-sync Claude Code CLI OAuth on the
|
||||
**gateway host**.
|
||||
switch to a **Claude Code setup-token** and paste it on the **gateway host**.
|
||||
|
||||
**Recommended (setup-token):**
|
||||
|
||||
```bash
|
||||
# Run on the gateway host (runs Claude Code CLI)
|
||||
# Run on the gateway host (paste the setup-token)
|
||||
clawdbot models auth setup-token --provider anthropic
|
||||
clawdbot models status
|
||||
```
|
||||
@@ -71,10 +70,6 @@ clawdbot models auth paste-token --provider anthropic
|
||||
clawdbot models status
|
||||
```
|
||||
|
||||
**If you want to keep OAuth reuse:**
|
||||
log in with Claude Code CLI on the gateway host, then run `clawdbot models status`
|
||||
to sync the refreshed token into Clawdbot’s auth store.
|
||||
|
||||
More detail: [Anthropic](/providers/anthropic) and [OAuth](/concepts/oauth).
|
||||
|
||||
### Control UI fails on HTTP ("device identity required" / "connect failed")
|
||||
|
||||
@@ -630,7 +630,7 @@ Docs: [Anthropic](/providers/anthropic), [OpenAI](/providers/openai),
|
||||
|
||||
### Can I use Claude Max subscription without an API key
|
||||
|
||||
Yes. You can authenticate with **Claude Code CLI OAuth** or a **setup-token**
|
||||
Yes. You can authenticate with a **setup-token**
|
||||
instead of an API key. This is the subscription path.
|
||||
|
||||
Claude Pro/Max subscriptions **do not include an API key**, so this is the
|
||||
@@ -640,11 +640,7 @@ If you want the most explicit, supported path, use an Anthropic API key.
|
||||
|
||||
### How does Anthropic setuptoken auth work
|
||||
|
||||
`claude setup-token` generates a **token string** via the Claude Code CLI (it is not available in the web console). You can run it on **any machine**. If Claude Code CLI credentials are present on the gateway host, Clawdbot can reuse them; otherwise choose **Anthropic token (paste setup-token)** and paste the string. The token is stored as an auth profile for the **anthropic** provider and used like an API key or OAuth profile. More detail: [OAuth](/concepts/oauth).
|
||||
|
||||
Clawdbot keeps `auth.profiles["anthropic:claude-cli"].mode` set to `"oauth"` so
|
||||
the profile accepts both OAuth and setup-token credentials; older `"token"` mode
|
||||
entries auto-migrate.
|
||||
`claude setup-token` generates a **token string** via the Claude Code CLI (it is not available in the web console). You can run it on **any machine**. Choose **Anthropic token (paste setup-token)** in the wizard or paste it with `clawdbot models auth paste-token --provider anthropic`. The token is stored as an auth profile for the **anthropic** provider and used like an API key (no auto-refresh). More detail: [OAuth](/concepts/oauth).
|
||||
|
||||
### Where do I find an Anthropic setuptoken
|
||||
|
||||
@@ -656,9 +652,9 @@ claude setup-token
|
||||
|
||||
Copy the token it prints, then choose **Anthropic token (paste setup-token)** in the wizard. If you want to run it on the gateway host, use `clawdbot models auth setup-token --provider anthropic`. If you ran `claude setup-token` elsewhere, paste it on the gateway host with `clawdbot models auth paste-token --provider anthropic`. See [Anthropic](/providers/anthropic).
|
||||
|
||||
### Do you support Claude subscription auth Claude Code OAuth
|
||||
### Do you support Claude subscription auth (Claude Pro/Max)
|
||||
|
||||
Yes. Clawdbot can **reuse Claude Code CLI credentials** (OAuth) and also supports **setup-token**. If you have a Claude subscription, we recommend **setup-token** for long‑running setups (requires Claude Pro/Max + the `claude` CLI). You can generate it anywhere and paste it on the gateway host. OAuth reuse is supported, but avoid logging in separately via Clawdbot and Claude Code to prevent token conflicts. See [Anthropic](/providers/anthropic) and [OAuth](/concepts/oauth).
|
||||
Yes — via **setup-token**. Clawdbot no longer reuses Claude Code CLI OAuth tokens; use a setup-token or an Anthropic API key. Generate the token anywhere and paste it on the gateway host. See [Anthropic](/providers/anthropic) and [OAuth](/concepts/oauth).
|
||||
|
||||
Note: Claude subscription access is governed by Anthropic’s terms. For production or multi‑user workloads, API keys are usually the safer choice.
|
||||
|
||||
@@ -678,13 +674,12 @@ Yes - via pi‑ai’s **Amazon Bedrock (Converse)** provider with **manual confi
|
||||
|
||||
### How does Codex auth work
|
||||
|
||||
Clawdbot supports **OpenAI Code (Codex)** via OAuth or by reusing your Codex CLI login (`~/.codex/auth.json`). The wizard can import the CLI login or run the OAuth flow and will set the default model to `openai-codex/gpt-5.2` when appropriate. See [Model providers](/concepts/model-providers) and [Wizard](/start/wizard).
|
||||
Clawdbot supports **OpenAI Code (Codex)** via OAuth (ChatGPT sign-in). The wizard can run the OAuth flow and will set the default model to `openai-codex/gpt-5.2` when appropriate. See [Model providers](/concepts/model-providers) and [Wizard](/start/wizard).
|
||||
|
||||
### Do you support OpenAI subscription auth Codex OAuth
|
||||
|
||||
Yes. Clawdbot fully supports **OpenAI Code (Codex) subscription OAuth** and can also reuse an
|
||||
existing Codex CLI login (`~/.codex/auth.json`) on the gateway host. The onboarding wizard
|
||||
can import the CLI login or run the OAuth flow for you.
|
||||
Yes. Clawdbot fully supports **OpenAI Code (Codex) subscription OAuth**. The onboarding wizard
|
||||
can run the OAuth flow for you.
|
||||
|
||||
See [OAuth](/concepts/oauth), [Model providers](/concepts/model-providers), and [Wizard](/start/wizard).
|
||||
|
||||
@@ -1940,8 +1935,8 @@ You can list available models with `/model`, `/model list`, or `/model status`.
|
||||
You can also force a specific auth profile for the provider (per session):
|
||||
|
||||
```
|
||||
/model opus@anthropic:claude-cli
|
||||
/model opus@anthropic:default
|
||||
/model opus@anthropic:work
|
||||
```
|
||||
|
||||
Tip: `/model status` shows which agent is active, which `auth-profiles.json` file is being used, and which auth profile will be tried next.
|
||||
@@ -2145,21 +2140,17 @@ It means the system attempted to use the auth profile ID `anthropic:default`, bu
|
||||
- **Sanity‑check model/auth status**
|
||||
- Use `clawdbot models status` to see configured models and whether providers are authenticated.
|
||||
|
||||
**Fix checklist for No credentials found for profile anthropic claude cli**
|
||||
**Fix checklist for No credentials found for profile anthropic**
|
||||
|
||||
This means the run is pinned to the **Claude Code CLI** profile, but the Gateway
|
||||
can’t find that profile in its auth store.
|
||||
This means the run is pinned to an Anthropic auth profile, but the Gateway
|
||||
can’t find it in its auth store.
|
||||
|
||||
- **Sync the Claude Code CLI token on the gateway host**
|
||||
- Run `clawdbot models status` (it loads + syncs Claude Code CLI credentials).
|
||||
- If it still says missing: run `claude setup-token` (or `clawdbot models auth setup-token --provider anthropic`) and retry.
|
||||
- **If the token was created on another machine**
|
||||
- Paste it into the gateway host with `clawdbot models auth paste-token --provider anthropic`.
|
||||
- **Check the profile mode**
|
||||
- `auth.profiles["anthropic:claude-cli"].mode` must be `"oauth"` (token mode rejects OAuth credentials).
|
||||
- **Use a setup-token**
|
||||
- Run `claude setup-token`, then paste it with `clawdbot models auth setup-token --provider anthropic`.
|
||||
- If the token was created on another machine, use `clawdbot models auth paste-token --provider anthropic`.
|
||||
- **If you want to use an API key instead**
|
||||
- Put `ANTHROPIC_API_KEY` in `~/.clawdbot/.env` on the **gateway host**.
|
||||
- Clear any pinned order that forces `anthropic:claude-cli`:
|
||||
- Clear any pinned order that forces a missing profile:
|
||||
```bash
|
||||
clawdbot models auth order clear --provider anthropic
|
||||
```
|
||||
@@ -2181,7 +2172,7 @@ Fix: Clawdbot now strips unsigned thinking blocks for Google Antigravity Claude.
|
||||
|
||||
## Auth profiles: what they are and how to manage them
|
||||
|
||||
Related: [/concepts/oauth](/concepts/oauth) (OAuth flows, token storage, multi-account patterns, CLI sync)
|
||||
Related: [/concepts/oauth](/concepts/oauth) (OAuth flows, token storage, multi-account patterns)
|
||||
|
||||
### What is an auth profile
|
||||
|
||||
@@ -2212,10 +2203,10 @@ You can also set a **per-agent** order override (stored in that agent’s `auth-
|
||||
clawdbot models auth order get --provider anthropic
|
||||
|
||||
# Lock rotation to a single profile (only try this one)
|
||||
clawdbot models auth order set --provider anthropic anthropic:claude-cli
|
||||
clawdbot models auth order set --provider anthropic anthropic:default
|
||||
|
||||
# Or set an explicit order (fallback within provider)
|
||||
clawdbot models auth order set --provider anthropic anthropic:claude-cli anthropic:default
|
||||
clawdbot models auth order set --provider anthropic anthropic:work anthropic:default
|
||||
|
||||
# Clear override (fall back to config auth.order / round-robin)
|
||||
clawdbot models auth order clear --provider anthropic
|
||||
@@ -2224,7 +2215,7 @@ clawdbot models auth order clear --provider anthropic
|
||||
To target a specific agent:
|
||||
|
||||
```bash
|
||||
clawdbot models auth order set --provider anthropic --agent main anthropic:claude-cli
|
||||
clawdbot models auth order set --provider anthropic --agent main anthropic:default
|
||||
```
|
||||
|
||||
### OAuth vs API key whats the difference
|
||||
@@ -2234,7 +2225,7 @@ Clawdbot supports both:
|
||||
- **OAuth** often leverages subscription access (where applicable).
|
||||
- **API keys** use pay‑per‑token billing.
|
||||
|
||||
The wizard explicitly supports Anthropic OAuth and OpenAI Codex OAuth and can store API keys for you.
|
||||
The wizard explicitly supports Anthropic setup-token and OpenAI Codex OAuth and can store API keys for you.
|
||||
|
||||
## Gateway: ports, “already running”, and remote mode
|
||||
|
||||
|
||||
@@ -1,14 +1,13 @@
|
||||
---
|
||||
summary: "Use Anthropic Claude via API keys or Claude Code CLI auth in Clawdbot"
|
||||
summary: "Use Anthropic Claude via API keys or setup-token in Clawdbot"
|
||||
read_when:
|
||||
- You want to use Anthropic models in Clawdbot
|
||||
- You want setup-token or Claude Code CLI auth instead of API keys
|
||||
- You want setup-token instead of API keys
|
||||
---
|
||||
# Anthropic (Claude)
|
||||
|
||||
Anthropic builds the **Claude** model family and provides access via an API.
|
||||
In Clawdbot you can authenticate with an API key or reuse **Claude Code CLI** credentials
|
||||
(setup-token or OAuth).
|
||||
In Clawdbot you can authenticate with an API key or a **setup-token**.
|
||||
|
||||
## Option A: Anthropic API key
|
||||
|
||||
@@ -37,7 +36,7 @@ clawdbot onboard --anthropic-api-key "$ANTHROPIC_API_KEY"
|
||||
## Prompt caching (Anthropic API)
|
||||
|
||||
Clawdbot does **not** override Anthropic’s default cache TTL unless you set it.
|
||||
This is **API-only**; Claude Code CLI OAuth ignores TTL settings.
|
||||
This is **API-only**; subscription auth does not honor TTL settings.
|
||||
|
||||
To set the TTL per model, use `cacheControlTtl` in the model `params`:
|
||||
|
||||
@@ -58,9 +57,9 @@ To set the TTL per model, use `cacheControlTtl` in the model `params`:
|
||||
Clawdbot includes the `extended-cache-ttl-2025-04-11` beta flag for Anthropic API
|
||||
requests; keep it if you override provider headers (see [/gateway/configuration](/gateway/configuration)).
|
||||
|
||||
## Option B: Claude Code CLI (setup-token or OAuth)
|
||||
## Option B: Claude setup-token
|
||||
|
||||
**Best for:** using your Claude subscription or existing Claude Code CLI login.
|
||||
**Best for:** using your Claude subscription.
|
||||
|
||||
### Where to get a setup-token
|
||||
|
||||
@@ -85,8 +84,8 @@ clawdbot models auth paste-token --provider anthropic
|
||||
### CLI setup
|
||||
|
||||
```bash
|
||||
# Reuse Claude Code CLI OAuth credentials if already logged in
|
||||
clawdbot onboard --auth-choice claude-cli
|
||||
# Paste a setup-token during onboarding
|
||||
clawdbot onboard --auth-choice setup-token
|
||||
```
|
||||
|
||||
### Config snippet
|
||||
@@ -100,10 +99,7 @@ clawdbot onboard --auth-choice claude-cli
|
||||
## Notes
|
||||
|
||||
- Generate the setup-token with `claude setup-token` and paste it, or run `clawdbot models auth setup-token` on the gateway host.
|
||||
- If you see “OAuth token refresh failed …” on a Claude subscription, re-auth with a setup-token or resync Claude Code CLI OAuth on the gateway host. See [/gateway/troubleshooting#oauth-token-refresh-failed-anthropic-claude-subscription](/gateway/troubleshooting#oauth-token-refresh-failed-anthropic-claude-subscription).
|
||||
- Clawdbot writes `auth.profiles["anthropic:claude-cli"].mode` as `"oauth"` so the profile
|
||||
accepts both OAuth and setup-token credentials. Older configs using `"token"` are
|
||||
auto-migrated on load.
|
||||
- If you see “OAuth token refresh failed …” on a Claude subscription, re-auth with a setup-token. See [/gateway/troubleshooting#oauth-token-refresh-failed-anthropic-claude-subscription](/gateway/troubleshooting#oauth-token-refresh-failed-anthropic-claude-subscription).
|
||||
- Auth details + reuse rules are in [/concepts/oauth](/concepts/oauth).
|
||||
|
||||
## Troubleshooting
|
||||
@@ -119,7 +115,7 @@ clawdbot onboard --auth-choice claude-cli
|
||||
- Re-run onboarding for that agent, or paste a setup-token / API key on the
|
||||
gateway host, then verify with `clawdbot models status`.
|
||||
|
||||
**No credentials found for profile `anthropic:default` or `anthropic:claude-cli`**
|
||||
**No credentials found for profile `anthropic:default`**
|
||||
- Run `clawdbot models status` to see which auth profile is active.
|
||||
- Re-run onboarding, or paste a setup-token / API key for that profile.
|
||||
|
||||
|
||||
@@ -141,5 +141,5 @@ launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.claude-max-api.plist
|
||||
|
||||
## See Also
|
||||
|
||||
- [Anthropic provider](/providers/anthropic) - Native Clawdbot integration with Claude Code CLI OAuth
|
||||
- [Anthropic provider](/providers/anthropic) - Native Clawdbot integration with Claude setup-token or API keys
|
||||
- [OpenAI provider](/providers/openai) - For OpenAI/Codex subscriptions
|
||||
|
||||
@@ -7,9 +7,7 @@ read_when:
|
||||
# OpenAI
|
||||
|
||||
OpenAI provides developer APIs for GPT models. Codex supports **ChatGPT sign-in** for subscription
|
||||
access or **API key** sign-in for usage-based access. Codex cloud requires ChatGPT sign-in, while
|
||||
the Codex CLI supports either sign-in method. The Codex CLI caches login details in
|
||||
`~/.codex/auth.json` (or your OS credential store), which Clawdbot can reuse.
|
||||
access or **API key** sign-in for usage-based access. Codex cloud requires ChatGPT sign-in.
|
||||
|
||||
## Option A: OpenAI API key (OpenAI Platform)
|
||||
|
||||
@@ -38,16 +36,14 @@ clawdbot onboard --openai-api-key "$OPENAI_API_KEY"
|
||||
**Best for:** using ChatGPT/Codex subscription access instead of an API key.
|
||||
Codex cloud requires ChatGPT sign-in, while the Codex CLI supports ChatGPT or API key sign-in.
|
||||
|
||||
Clawdbot can reuse your **Codex CLI** login (`~/.codex/auth.json`) or run the OAuth flow.
|
||||
|
||||
### CLI setup
|
||||
|
||||
```bash
|
||||
# Reuse existing Codex CLI login
|
||||
clawdbot onboard --auth-choice codex-cli
|
||||
|
||||
# Or run Codex OAuth in the wizard
|
||||
# Run Codex OAuth in the wizard
|
||||
clawdbot onboard --auth-choice openai-codex
|
||||
|
||||
# Or run OAuth directly
|
||||
clawdbot models auth login --provider openai-codex
|
||||
```
|
||||
|
||||
### Config snippet
|
||||
|
||||
@@ -132,7 +132,7 @@ Examples:
|
||||
/model list
|
||||
/model 3
|
||||
/model openai/gpt-5.2
|
||||
/model opus@anthropic:claude-cli
|
||||
/model opus@anthropic:default
|
||||
/model status
|
||||
```
|
||||
|
||||
|
||||
Reference in New Issue
Block a user