> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentvault.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect OpenClaw

> Add Agent Vault to OpenClaw with one command and sign in, in about 2 minutes.

Connect OpenClaw to Agent Vault so it can check out and sign in for you, using
only mock tokens. It takes about 2 minutes: one command adds the server, and you
sign in once in your browser.

<Frame caption="Copy the line for OpenClaw from your dashboard, then add the server and sign in.">
  <video controls muted playsInline preload="metadata" className="w-full" poster="/images/agents/openclaw-poster.webp" src="https://mintcdn.com/self-labs/VeDWRFlNWGO5jQN6/videos/agents/openclaw.mp4?fit=max&auto=format&n=VeDWRFlNWGO5jQN6&q=85&s=a10cff47634c570a41909ed5fcc8223f" aria-label="A terminal running openclaw mcp set and openclaw mcp login next to the dashboard's Connect another agent panel with OpenClaw picked." data-path="videos/agents/openclaw.mp4" />
</Frame>

<Warning>
  Anyone who can message your OpenClaw can use your Agent Vault through it: pay
  with your cards, within each card's limits, and use your saved logins. Connect
  Agent Vault only on an OpenClaw gateway that you alone use. If other people,
  group chats or shared channels can reach the gateway, set up a separate gateway
  just for yourself and connect it there.
</Warning>

## Before you start

* An Agent Vault account, with a card if your agent will check out. New here?
  The [Quickstart](/get-started/quickstart) sets one up in about 5 minutes.
* OpenClaw, on a gateway only you use.

## Connect OpenClaw

<Tabs>
  <Tab title="Paste one line">
    <Steps>
      <Step title="Paste this into OpenClaw">
        ```text theme={null}
        Read https://mcp.agentvault.io/skill.md and follow it to connect Agent Vault.
        ```

        OpenClaw reads the connect skill, checks that the gateway is yours alone, and
        adds the server with OAuth turned on.
      </Step>

      <Step title="Sign in">
        OpenClaw starts the sign-in and sends you a link. Open it and sign in on the
        Agent Vault sign-in page, with your Agent Vault account.

        If OpenClaw runs on a server, your browser then fails to load an address
        starting with `http://127.0.0.1`. That is expected: copy the whole address and
        send it back to OpenClaw within a few minutes, before the code in it expires.

        Some OpenClaw versions won't add a server or sign in while the gateway is
        running. Then OpenClaw sends no link and asks you to do it yourself: in the
        Control UI, open **Settings → MCP** and select **Add server**. Name it
        `agent-vault`, choose **Streamable HTTP**, enter `https://mcp.agentvault.io/mcp`,
        then select **Sign in** for it.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Set it up by hand">
    <Note>
      The commands and paths on this page are for OpenClaw's default profile. If your
      gateway runs under a profile (`openclaw --profile <name> …`), add
      `--profile <name>` right after `openclaw` in every command on this page,
      `openclaw gateway` ones included, and use `~/.openclaw-<name>/openclaw.json`
      instead of `~/.openclaw/openclaw.json`.
    </Note>

    <Steps>
      <Step title="Add the server">
        Run this where OpenClaw runs:

        ```bash theme={null}
        openclaw mcp set agent-vault '{"url":"https://mcp.agentvault.io/mcp","transport":"streamable-http","auth":"oauth"}'
        ```

        OpenClaw answers `Saved MCP server "agent-vault"`.

        Some OpenClaw versions refuse this, and `openclaw mcp login` below, while the
        gateway is running. If it asks you to stop the gateway, run `openclaw gateway stop`,
        run both commands, then `openclaw gateway start`. Or add the server and sign in
        from the Control UI instead: **Settings → MCP**, **Add server**, then **Sign in**.
      </Step>

      <Step title="Sign in">
        ```bash theme={null}
        openclaw mcp login agent-vault
        ```

        Open the link it prints and sign in on the Agent Vault sign-in page.

        If OpenClaw runs on a server, your browser then fails to load an address
        starting with `http://127.0.0.1`. Copy it, take the `code` value from it, and
        run this within a few minutes:

        ```bash theme={null}
        openclaw mcp login agent-vault --code <code>
        ```
      </Step>
    </Steps>

    <AccordionGroup>
      <Accordion title="Add it in the config file instead">
        Add this under `mcp.servers` in `~/.openclaw/openclaw.json`, keeping everything
        already in the file:

        ```json ~/.openclaw/openclaw.json theme={null}
        {
          "agent-vault": {
            "url": "https://mcp.agentvault.io/mcp",
            "transport": "streamable-http",
            "auth": "oauth"
          }
        }
        ```

        An edit to the file may not reach a running OpenClaw. If the Agent Vault tools
        don't appear after sign-in, run `openclaw gateway restart`, then start a new
        chat.
      </Accordion>

      <Accordion title="Add it from OpenClaw's chat instead">
        As the owner, send this in OpenClaw's chat. It needs `commands.mcp: true` in
        your OpenClaw settings.

        ```text theme={null}
        /mcp set agent-vault={"url":"https://mcp.agentvault.io/mcp","transport":"streamable-http","auth":"oauth"}
        ```
      </Accordion>

      <Accordion title="Add it when OpenClaw's shell runs in a sandbox">
        A command run inside the sandbox changes the sandbox's copy, not the gateway's.
        Set it up on the gateway instead:

        1. In the OpenClaw Control UI, open **Settings → MCP**, select **Add server**,
           name it `agent-vault`, choose **Streamable HTTP** and enter
           `https://mcp.agentvault.io/mcp`.
        2. Select **Sign in** for `agent-vault` on the same page, and sign in.
        3. Let the tools through the sandbox's tool policy. Add this to
           `~/.openclaw/openclaw.json`, merged with any `tools` settings already there,
           then run `openclaw gateway restart`:

           ```json theme={null}
           { "tools": { "sandbox": { "tools": { "alsoAllow": ["agent-vault__*"] } } } }
           ```

           If `tools.sandbox.tools.allow` is already set, append `"agent-vault__*"` to
           that list instead. OpenClaw rejects a config with both.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

## Choose what it may use

A new connection starts with nothing granted, so your agent can't use a card or
a login yet. Until you choose, its first tool call answers:

```text theme={null}
Choose what this app may use in Agent Vault before it can act: open the connection's page in the dashboard.
```

The connection itself appears in the dashboard only once your agent makes its
first tool call, so make that call first.

<Steps>
  <Step title="Make a first call">
    Ask your agent to call `get_token_catalog`. It answers with the message above,
    and the call creates the connection.
  </Step>

  <Step title="Open Connected apps">
    In the dashboard sidebar, under **Vault**, click **Connected apps**. The new
    connection's row shows **Choose what it may use**.
  </Step>

  <Step title="Pick its cards and logins">
    Click **Choose access**. Under **Cards** and **Logins**, pick **All**, or keep
    **Only selected** and tick the ones this agent may use.
  </Step>

  <Step title="Check the choices, then click Save access">
    Your first connection's dialog opens with nothing ticked. After that, a new
    connection's dialog opens with the choices of the connection you used most
    recently, so saving it unchanged grants the same cards and logins, and the same
    three switches: **Let this app create and change its own logins**, **Ask me
    before every purchase from this app** and **Fill a test card instead of my
    card**. Check all of them for this agent before you click **Save access**.
  </Step>
</Steps>

You can change or revoke the connection on the same page at any time. See
[Connected apps](/dashboard/api-keys#connected-apps).

## Check it works

Ask OpenClaw to call the Agent Vault tool `get_token_catalog`. It answers with
the mock tokens for the cards and logins you allowed, such as
`av_card_1_number_u7x2k`. Your real card number never reaches OpenClaw.

## Troubleshooting

<AccordionGroup>
  <Accordion title="The Agent Vault tools don't appear">
    Run `openclaw gateway restart`, then start a new chat and ask again.
  </Accordion>

  <Accordion title="Sign-in ends on a page that won't load">
    OpenClaw runs on a different machine from your browser, so the sign-in callback
    can't reach it. Copy the whole `http://127.0.0.1` address and finish with
    `openclaw mcp login agent-vault --code <code>`, as in **Set it up by hand**.
  </Accordion>

  <Accordion title="The first tool call says to choose what this app may use">
    The connection has nothing granted yet. Follow
    [Choose what it may use](#choose-what-it-may-use), then ask again.
  </Accordion>
</AccordionGroup>

<Tip>
  For OpenClaw, the dashboard recommends an API key over signing in: in testing,
  sign-in was slower or failed more often. Its OpenClaw setup leads with one
  command that stores your key in OpenClaw's skill settings, so the key never goes
  through a chat. On **Overview**, open **Connect another agent** and pick
  **OpenClaw**.
</Tip>

## Next

<CardGroup cols={2}>
  <Card title="Your first checkout" icon="cart-shopping" href="/guides/first-checkout">
    Have OpenClaw buy something, start to finish.
  </Card>

  <Card title="Rules of engagement" icon="scale-balanced" href="/mcp/rules-of-engagement">
    What your agent must and must not do with the tools.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.