Vault Enhancements w/ UI

11. Auth Profiles Display

Auth profile keys (from auth-profiles.json) that are stored in the vault are listed with their status. Backend RPCs support listing, error reset, and deletion.

Architecture

Security Model

┌──────────────────────────────────────────────────────────┐
│  Browser                                                  │
│  ┌──────────────────────────────────────────────────┐    │
│  │  Vault Tab                                        │    │
│  │  ┌──────────────────────────────────────────┐    │    │
│  │  │ OpenAI: [••••••••••] [Save] [✕]  🟢VAULT │    │    │
│  │  │ Anthropic: [        ] [Save]     ⚪NOT SET│    │    │
│  │  │ + Add Secret  [KEY_NAME] [value] [Save]   │    │    │
│  │  └──────────────────────────────────────────┘    │    │
│  │                                                   │    │
│  │  Skills Tab                                       │    │
│  │  ┌──────────────────────────────────────────┐    │    │
│  │  │ whisper-api: 🔒 OPENAI_API_KEY  [Unlink] │    │    │
│  │  │ sag:         [Select vault key ▾]         │    │    │
│  │  └──────────────────────────────────────────┘    │    │
│  └──────────────────────────────────────────────────┘    │
│                           │                               │
│                           ▼ (direct RPC, not via agent)   │
└───────────────────────────┼───────────────────────────────┘
                            │
                    ┌───────▼───────┐
                    │   Gateway     │
                    │ secrets.write │
                    │ skills.update │
                    └──┬─────────┬──┘
                       │         │
              ┌────────▼──┐  ┌──▼────────────┐
              │ secrets.   │  │ openclaw.json  │
              │ json       │  │ (SecretRef     │
              │ (0600)     │  │  objects only) │
              └────────────┘  └────────────────┘

Backend RPCs

| Method | Description | |--------|-------------| | secrets.status | Vault file status, key count, plaintext count | | secrets.list | List secret IDs with masked values | | secrets.write | Store key in vault + optionally update config with SecretRef. envEntry param (default true) controls whether an env block entry is created. Returns restartNeeded flag instead of auto-reloading. | | secrets.delete | Remove from vault + config | | secrets.migrate | Batch-migrate all plaintext keys to vault | | secrets.authProfiles.list | List auth profile keys with vault status | | secrets.authProfiles.resetErrors | Reset auth profile error state | | secrets.authProfiles.delete | Delete an auth profile | | skills.update | Updated with vaultKeyId param — writes a SecretRef to skills.entries..apiKey or unlinks (empty string) |

Skills-Status Integration

SkillStatusEntry includes a vaultKeyId field that reads the raw config JSON (not the runtime-resolved config where SecretRefs are replaced with resolved strings). This is done via extractVaultKeyIdFromConfig() which reads and caches openclaw.json directly, checking for SecretRef objects in skills.entries..apiKey.

Restart Behavior

No auto-restart on vault save. Previously, secrets.write called reloadSecrets() which could trigger a gateway restart. Now:

OpenClaw Secrets System Integration

This skill uses OpenClaw's built-in Secrets System (src/secrets/):

The secrets system also supports env and exec providers for advanced setups (e.g., environment variables, external vault commands). The file provider is the default for this UI.

Files Modified (Source Locations in OpenClaw Repo)

| File | Purpose | |------|---------| | src/gateway/server-methods/secrets.ts | Vault RPCs (status, list, write, delete, migrate, authProfiles) | | src/gateway/server-methods/skills.ts | Skills update with vaultKeyId param | | src/gateway/server-methods/plugins-ui.ts | Plugin view registration | | src/gateway/protocol/schema/agents-models-skills.ts | vaultKeyId in SkillsUpdateParamsSchema | | src/agents/skills-status.ts | vaultKeyId field on SkillStatusEntry, raw config reader | | ui/src/ui/controllers/apikeys.ts | Vault-aware state, addVaultSecret, loadVaultOnlyKeys | | ui/src/ui/controllers/skills.ts | VaultKeyEntry type, loadVaultKeys, linkSkillToVaultKey, addVaultKeyAndLink | | ui/src/ui/views/apikeys.ts | Vault UI (banners, badges, migration, add form, vault-only keys, restart banner) | | ui/src/ui/views/skills.ts | Vault key selector dropdown, inline creation, expanded groups | | ui/src/ui/app.ts | State properties (vault, restart, skill key management) | | ui/src/ui/app-render.ts | Prop wiring for vault and skills | | ui/src/ui/app-settings.ts | Tab load triggers for vault keys | | ui/src/ui/types.ts | vaultKeyId on SkillStatusEntry | | ui/src/ui/navigation.ts | Vault tab (lock icon), removed 1password/discord standalone tabs |

Reference Files

apikeys-ui/
├── SKILL.md                              # This file
├── INSTALL_INSTRUCTIONS.md               # Step-by-step installation (legacy)
└── reference/
    ├── apikeys-controller.ts             # UI controller (vault tab)
    ├── apikeys-views.ts                  # UI view (vault tab)
    ├── secrets-rpc.ts                    # Backend vault RPCs
    ├── skills-controller.ts              # UI controller (skills vault integration)
    ├── skills-views.ts                   # UI view (vault key selector)
    ├── skills-status.ts                  # Backend skill status with vaultKeyId
    └── skills-rpc.ts                     # Backend skills update RPC

Key Design Decisions

1. No auto-restart on save — secrets.write no longer calls reloadSecrets(). A restart banner with "Restart Now" button lets the user decide when to restart.

2. Vault-only keys — Keys created with envEntry: false don't appear in config. A separate secrets.list call finds all vault entries and shows orphan keys in a dedicated section.

3. Raw config reading for vaultKeyId — The runtime resolves SecretRefs to strings, so loadConfig() returns resolved values. extractVaultKeyIdFromConfig() reads the raw JSON file directly (with mtime caching) to detect SecretRef objects.

4. Skills expanded by default — All