Connect OpenClaw

Connect OpenClaw to Agent Vault so it can check out and sign in for you, using only mock tokens. It takes about 2 minutes: one command adds the server, and you sign in once in your browser.

Copy the line for OpenClaw from your dashboard, then add the server and sign in.

Anyone who can message your OpenClaw can use your Agent Vault through it: pay with your cards, within each card’s limits, and use your saved logins. Connect Agent Vault only on an OpenClaw gateway that you alone use. If other people, group chats or shared channels can reach the gateway, set up a separate gateway just for yourself and connect it there.

Before you start

An Agent Vault account, with a card if your agent will check out. New here? The Quickstart sets one up in about 5 minutes.
OpenClaw, on a gateway only you use.

Paste one line
Set it up by hand

Paste this into OpenClaw

Read https://mcp.agentvault.io/skill.md and follow it to connect Agent Vault.

OpenClaw reads the connect skill, checks that the gateway is yours alone, and adds the server with OAuth turned on.

OpenClaw starts the sign-in and sends you a link. Open it and sign in on the Agent Vault sign-in page, with your Agent Vault account.If OpenClaw runs on a server, your browser then fails to load an address starting with http://127.0.0.1. That is expected: copy the whole address and send it back to OpenClaw within a few minutes, before the code in it expires.Some OpenClaw versions won’t add a server or sign in while the gateway is running. Then OpenClaw sends no link and asks you to do it yourself: in the Control UI, open Settings → MCP and select Add server. Name it agent-vault, choose Streamable HTTP, enter https://mcp.agentvault.io/mcp, then select Sign in for it.

The commands and paths on this page are for OpenClaw’s default profile. If your gateway runs under a profile (openclaw --profile <name> …), add --profile <name> right after openclaw in every command on this page, openclaw gateway ones included, and use ~/.openclaw-<name>/openclaw.json instead of ~/.openclaw/openclaw.json.

Add the server

Run this where OpenClaw runs:

openclaw mcp set agent-vault '{"url":"https://mcp.agentvault.io/mcp","transport":"streamable-http","auth":"oauth"}'

OpenClaw answers Saved MCP server "agent-vault".Some OpenClaw versions refuse this, and openclaw mcp login below, while the gateway is running. If it asks you to stop the gateway, run openclaw gateway stop, run both commands, then openclaw gateway start. Or add the server and sign in from the Control UI instead: Settings → MCP, Add server, then Sign in.

openclaw mcp login agent-vault

Open the link it prints and sign in on the Agent Vault sign-in page.If OpenClaw runs on a server, your browser then fails to load an address starting with http://127.0.0.1. Copy it, take the code value from it, and run this within a few minutes:

openclaw mcp login agent-vault --code <code>

Add it in the config file instead

Add this under mcp.servers in ~/.openclaw/openclaw.json, keeping everything already in the file:

~/.openclaw/openclaw.json

{
  "agent-vault": {
    "url": "https://mcp.agentvault.io/mcp",
    "transport": "streamable-http",
    "auth": "oauth"
  }
}

An edit to the file may not reach a running OpenClaw. If the Agent Vault tools don’t appear after sign-in, run openclaw gateway restart, then start a new chat.

Add it from OpenClaw's chat instead

As the owner, send this in OpenClaw’s chat. It needs commands.mcp: true in your OpenClaw settings.

/mcp set agent-vault={"url":"https://mcp.agentvault.io/mcp","transport":"streamable-http","auth":"oauth"}

Add it when OpenClaw's shell runs in a sandbox

A command run inside the sandbox changes the sandbox’s copy, not the gateway’s. Set it up on the gateway instead:

In the OpenClaw Control UI, open Settings → MCP, select Add server, name it agent-vault, choose Streamable HTTP and enter https://mcp.agentvault.io/mcp.
Select Sign in for agent-vault on the same page, and sign in.
Let the tools through the sandbox’s tool policy. Add this to ~/.openclaw/openclaw.json, merged with any tools settings already there, then run openclaw gateway restart:
{ "tools": { "sandbox": { "tools": { "alsoAllow": ["agent-vault__*"] } } } }
If tools.sandbox.tools.allow is already set, append "agent-vault__*" to that list instead. OpenClaw rejects a config with both.

Choose what it may use

A new connection starts with nothing granted, so your agent can’t use a card or a login yet. Until you choose, its first tool call answers:

Choose what this app may use in Agent Vault before it can act: open the connection's page in the dashboard.

The connection itself appears in the dashboard only once your agent makes its first tool call, so make that call first.

Make a first call

Ask your agent to call get_token_catalog. It answers with the message above, and the call creates the connection.

Open Connected apps

In the dashboard sidebar, under Vault, click Connected apps. The new connection’s row shows Choose what it may use.

Pick its cards and logins

Click Choose access. Under Cards and Logins, pick All, or keep Only selected and tick the ones this agent may use.

Check the choices, then click Save access

Your first connection’s dialog opens with nothing ticked. After that, a new connection’s dialog opens with the choices of the connection you used most recently, so saving it unchanged grants the same cards and logins, and the same three switches: Let this app create and change its own logins, Ask me before every purchase from this app and Fill a test card instead of my card. Check all of them for this agent before you click Save access.

You can change or revoke the connection on the same page at any time. See Connected apps.

Check it works

Ask OpenClaw to call the Agent Vault tool get_token_catalog. It answers with the mock tokens for the cards and logins you allowed, such as av_card_1_number_u7x2k. Your real card number never reaches OpenClaw.

Troubleshooting

The Agent Vault tools don't appear

Run openclaw gateway restart, then start a new chat and ask again.

The first tool call says to choose what this app may use

The connection has nothing granted yet. Follow Choose what it may use, then ask again.

For OpenClaw, the dashboard recommends an API key over signing in: in testing, sign-in was slower or failed more often. Its OpenClaw setup leads with one command that stores your key in OpenClaw’s skill settings, so the key never goes through a chat. On Overview, open Connect another agent and pick OpenClaw.

Your first checkout

Have OpenClaw buy something, start to finish.

Rules of engagement

What your agent must and must not do with the tools.

Connect your agent

Connect OpenClaw

Before you start