Skip to main content

1Claw CLI

The @1claw/cli package provides a full-featured command-line interface for 1Claw. It is designed for CI/CD pipelines, DevOps workflows, and server environments.

Installation​

npm install -g @1claw/cli

Or run with npx:

npx @1claw/cli login

Authentication​

1claw login

This opens your browser to 1claw.xyz where you approve the login. The CLI polls until you confirm. Your token is stored in ~/.config/1claw/.

Email/password​

1claw login --email

Supports MFA if enabled on your account.

CI/CD (non-interactive)​

Set environment variables — no login needed:

export ONECLAW_TOKEN="your-jwt"
# or
export ONECLAW_API_KEY="1ck_..."
export ONECLAW_VAULT_ID="your-vault-uuid"   # optional; required for vault-scoped commands

Main commands​

AreaCommands
Authlogin, logout, whoami
Vaultsvault list, vault create, vault get, vault link, vault delete
Secretssecret list, secret get, secret set, secret delete, secret rotate, secret describe
CI/CDenv pull, env push, env run -- <command>
Agentsagent list, agent create, agent get, agent token
Policiespolicy list, policy create, policy delete
Sharingshare create, share list, share accept, share revoke
Billingbilling status, billing credits, billing usage
Auditaudit list
MFAmfa status, mfa enable, mfa disable
Configconfig list, config set, config get

CI/CD examples​

GitHub Actions​

- name: Deploy with secrets
  env:
      ONECLAW_TOKEN: ${{ secrets.ONECLAW_TOKEN }}
      ONECLAW_VAULT_ID: ${{ secrets.ONECLAW_VAULT_ID }}
  run: |
      npx @1claw/cli env pull -o .env.production
      npm run deploy

Run a command with secrets injected​

1claw env run -- npm start

Secrets from the linked (or ONECLAW_VAULT_ID) vault are injected as environment variables for the child process.

Configuration​

Config file: ~/.config/1claw/config.json.

  • api-url — API base URL (default: https://api.1claw.xyz)
  • output-format — table, json, or plain
  • default-vault — Default vault ID for commands that need one

Use 1claw config list and 1claw config set <key> <value> to view and update.

Device authorization flow​

When you run 1claw login (without --email), the CLI:

  1. Calls POST /v1/auth/device/code to get a device code and user code.
  2. Opens the dashboard at https://1claw.xyz/cli/verify?code=<user_code>.
  3. You approve the request in the browser (while logged in to 1Claw).
  4. The CLI polls POST /v1/auth/device/token until the backend marks the code approved, then receives a JWT and stores it.

This flow does not require typing your password in the terminal.

See also​