Built-in providers
| Provider | Paths | Risk Level | Credential Types |
|---|---|---|---|
| OpenClaw | ~/.openclaw/ | Critical | API keys, bot tokens, OAuth tokens, session keys |
| AWS | ~/.aws/ | Critical | Access keys, session tokens |
| SSH | ~/.ssh/ | High | Private keys (RSA, EC, Ed25519) |
| Docker | ~/.docker/ | Medium | Registry auth tokens |
| npm | ~/.npmrc | Medium | Registry auth tokens |
| Kubernetes | ~/.kube/ | High | Cluster credentials, service account tokens |
Auto-detection
Detect which providers have credential files present on the system.Looking up providers
Retrieve a specific provider by ID or list all available provider IDs.Risk classification
Credentials are classified into four risk levels. UsesortByRisk to prioritize the most dangerous credentials first, and getRiskLabel for display.
| Level | Meaning | Examples |
|---|---|---|
| Critical | Full account access, billing exposure | AWS root keys, OpenClaw API keys |
| High | Significant access, lateral movement risk | SSH private keys, Kubernetes configs |
| Medium | Scoped access to a single service | Docker registry tokens, npm auth tokens |
| Low | Informational or limited impact | Allowlists, read-only configs |
Path expansion
Provider locations use template variables in paths. TheexpandPath function resolves these to actual filesystem paths.
Provider location details
OpenClaw
The OpenClaw provider scans multiple file types under~/.openclaw/:
| Location | Files | What it contains |
|---|---|---|
credentials/whatsapp/ | creds.json | WhatsApp session keys per account |
credentials/ | *-allowFrom.json | Channel pairing allowlists |
agents/*/agent/ | auth-profiles.json | LLM API keys per agent |
credentials/ | oauth.json | OAuth tokens for connected services |
| Root | openclaw.json | Telegram, Slack, Discord bot tokens; gateway token |
AWS
| Location | Files | What it contains |
|---|---|---|
~/.aws/ | credentials | Access key ID and secret access key per profile |
~/.aws/ | config | SSO tokens, region configuration |
SSH
| Location | Files | What it contains |
|---|---|---|
~/.ssh/ | id_rsa, id_ed25519, id_ecdsa | Private keys (RSA, Ed25519, ECDSA) |
~/.ssh/ | config | SSH host configuration |
Docker
| Location | Files | What it contains |
|---|---|---|
~/.docker/ | config.json | Base64-encoded registry auth tokens |
npm
| Location | Files | What it contains |
|---|---|---|
~/ | .npmrc | Registry auth tokens (_authToken=...) |
Kubernetes
| Location | Files | What it contains |
|---|---|---|
~/.kube/ | config | Cluster endpoints, certificates, bearer tokens |