← Back to Skills Marketplace
TapAuth
by
Jonah Schwartz
· GitHub ↗
· v1.0.3
· MIT-0
683
Downloads
0
Stars
2
Active Installs
13
Versions
Install in OpenClaw
/install tapauth
Description
OAuth token provider for OpenClaw agents — Google Calendar, Gmail, GitHub, Slack, Linear, Notion, Vercel, Sentry, Asana, Discord, or Apify. Integrates with O...
Usage Guidance
TapAuth appears to do what it claims: create browser approval URLs, cache grant credentials locally, and let OpenClaw run the bundled script to fetch tokens into an in-memory secrets snapshot. Before installing, verify you trust the tapauth.ai service (the script contacts https://tapauth.ai by default) and are comfortable with the gateway running the included script as an exec secret provider. Note that the script saves grant credentials (grant ID and grant secret) to TAPAUTH_HOME with restrictive permissions — those are sensitive and required for token retrieval. Do not set TAPAUTH_BASE_URL to an untrusted host (it can redirect the script to another server). Finally, follow the SKILL.md rules: don't invoke tapauth.sh --token directly in shell substitutions or curl commands; instead configure the exec provider so tokens are resolved by OpenClaw.
Capability Analysis
Type: OpenClaw Skill
Name: tapauth
Version: 1.0.3
The TapAuth skill is a legitimate OAuth token broker designed to provide delegated access to various services (Google, GitHub, Slack, etc.) for OpenClaw agents. The core logic in `scripts/tapauth.sh` is well-implemented with security in mind, using a safe key-value parser to avoid 'eval' or 'source' and enforcing strict file permissions (600/700) for its local cache. The `SKILL.md` instructions follow security best practices by directing the AI agent to configure OpenClaw's internal secrets manager rather than handling raw tokens in shell commands, effectively reducing the risk of token leakage in logs or process lists.
Capability Tags
Capability Assessment
Purpose & Capability
The skill name/description (OAuth token provider for many services) matches the files and runtime instructions. It requires curl and bash (documented) and includes a script that calls tapauth.ai to create grants and retrieve tokens. There are no unrelated env vars, binaries, or external downloads requested.
Instruction Scope
SKILL.md explicitly confines the agent to creating grants and configuring OpenClaw's exec secrets provider rather than directly capturing tokens. It instructs editing ~/.openclaw/openclaw.json and running openclaw secrets reload so the gateway runs the script with --token. This is expected for an exec-provider integration, but it does require granting the gateway the ability to run the bundled script and to pass TAPAUTH_HOME/HOME into the provider environment.
Install Mechanism
No install spec or remote downloads; the skill is instruction-first with local bash scripts included. No extract-from-URL or package registry installs are present. Risk from install mechanism is low.
Credentials
The skill declares no required env vars but the runtime requires setting TAPAUTH_HOME (or relying on default) and passing HOME into the exec provider; this is reasonable. The script caches grant credentials (TAPAUTH_GRANT_ID and TAPAUTH_GRANT_SECRET) to TAPAUTH_HOME with 600 permissions — bearer tokens are not written to disk per the code. Be aware the grant secret is a credential stored locally; SKILL.md's ‘no API key needed’ statement is accurate (the grant is created automatically), but it is still a secret persisted on disk.
Persistence & Privilege
always is false and model invocation is not disabled. The skill instructs adding an exec provider to openclaw.json so the gateway will run the included script at startup/reload to resolve tokens — this is normal for a secrets exec provider. The skill does not request permanent platform-wide privileges beyond that standard integration.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install tapauth - After installation, invoke the skill by name or use
/tapauth - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.3
Cache-only credentials, expired-grant reauth, and OpenClaw packaging/docs updates
v2.0.3
Security hardening, safer grant reuse, and OpenClaw docs alignment
v2.0.2
Add Apify provider, OpenClaw references, Gmail reference
v2.0.1
feat: add --token flag for two-step approval flow; fix unbound variable crash; 5s polling interval
v2.0.0
v1.0.0: Removed google_sheets/google_docs providers. All providers now require explicit scopes. Added Discord provider with full scope support. Consolidated API under /api/v1/. Per-grant X25519 sealed box encryption.
v1.4.0
Updated provider coverage, improved SKILL.md documentation, updated tapauth.sh script
v1.3.0
Repo renamed from tapauth/tapauth-skill to tapauth/skill
v1.2.1
v1 CLI + OpenClaw secrets provider docs
v1.2.0
Added tapauth CLI script for JIT token fetching, v1 API endpoints (POST /api/v1/grants, GET /api/v1/token), Discord provider reference, updated all docs/blogs/skill to v1 patterns
v0.1.1
Add hCaptcha reality check, provider reference updates
v0.1.0
Synced from monorepo
v1.1.0
Fix domain to tapauth.ai, add all provider references (Asana, Slack, Discord, Dropbox, Figma, etc.)
v1.0.0
Initial publish: OAuth token broker skill for AI agents
Metadata
Frequently Asked Questions
What is TapAuth?
OAuth token provider for OpenClaw agents — Google Calendar, Gmail, GitHub, Slack, Linear, Notion, Vercel, Sentry, Asana, Discord, or Apify. Integrates with O... It is an AI Agent Skill for Claude Code / OpenClaw, with 683 downloads so far.
How do I install TapAuth?
Run "/install tapauth" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is TapAuth free?
Yes, TapAuth is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does TapAuth support?
TapAuth is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created TapAuth?
It is built and maintained by Jonah Schwartz (@schwartzdev); the current version is v1.0.3.
More Skills