Built-in providers
| Provider | Paths | Risk Level | Credential Types |
|---|---|---|---|
| OpenClaw | ~/.openclaw/ | Critical | API keys, bot tokens, OAuth tokens, session keys |
| AWS | ~/.aws/ | Critical | Access keys, session tokens |
| SSH | ~/.ssh/ | High | Private keys (RSA, EC, Ed25519) |
| Docker | ~/.docker/ | Medium | Registry auth tokens |
| npm | ~/.npmrc | Medium | Registry auth tokens |
| Kubernetes | ~/.kube/ | High | Cluster credentials, service account tokens |
Auto-detection
Detect which providers have credential files present on the system.Looking up providers
Retrieve a specific provider by ID or list all available provider IDs.Risk classification
Credentials are classified into four risk levels. UsesortByRisk to prioritize the most dangerous credentials first, and getRiskLabel for display.
| Level | Meaning | Examples |
|---|---|---|
| Critical | Full account access, billing exposure | AWS root keys, OpenClaw API keys |
| High | Significant access, lateral movement risk | SSH private keys, Kubernetes configs |
| Medium | Scoped access to a single service | Docker registry tokens, npm auth tokens |
| Low | Informational or limited impact | Allowlists, read-only configs |
Path expansion
Provider locations use template variables in paths. TheexpandPath function resolves these to actual filesystem paths.
Provider location details
OpenClaw
The OpenClaw provider scans multiple file types under~/.openclaw/:
| Location | Files | What it contains |
|---|---|---|
credentials/whatsapp/ | creds.json | WhatsApp session keys per account |
credentials/ | *-allowFrom.json | Channel pairing allowlists |
agents/*/agent/ | auth-profiles.json | LLM API keys per agent |
credentials/ | oauth.json | OAuth tokens for connected services |
| Root | openclaw.json | Telegram, Slack, Discord bot tokens; gateway token |
AWS
| Location | Files | What it contains |
|---|---|---|
~/.aws/ | credentials | Access key ID and secret access key per profile |
~/.aws/ | config | SSO tokens, region configuration |
SSH
| Location | Files | What it contains |
|---|---|---|
~/.ssh/ | id_rsa, id_ed25519, id_ecdsa | Private keys (RSA, Ed25519, ECDSA) |
~/.ssh/ | config | SSH host configuration |
Docker
| Location | Files | What it contains |
|---|---|---|
~/.docker/ | config.json | Base64-encoded registry auth tokens |
npm
| Location | Files | What it contains |
|---|---|---|
~/ | .npmrc | Registry auth tokens (_authToken=...) |
Kubernetes
| Location | Files | What it contains |
|---|---|---|
~/.kube/ | config | Cluster endpoints, certificates, bearer tokens |
Next steps
Scan & import
Use the locations registry to scan and import credentials into your vault.
Security architecture
Learn about the encryption model that protects discovered credentials.
Passport model
Understand how imported credentials become governed passports.