1Claw — Secret Management for AI Agents

# 1Claw — AI Agent Secrets Management > HSM-backed secret management for AI agents and humans. Zero-knowledge vault with envelope encryption, agent-native access control, customer-managed encryption keys (CMEK), Intents API for transaction signing, and x402 micropayments. ## Links - Website: https://1claw.xyz - API: https://api.1claw.xyz - Docs: https://docs.1claw.xyz - MCP Server: https://mcp.1claw.xyz - Shroud (TEE proxy): https://shroud.1claw.xyz - Dashboard: https://1claw.xyz (login required) - GitHub: https://github.com/1clawAI/1claw - npm SDK: https://www.npmjs.com/package/@1claw/sdk - npm CLI: https://www.npmjs.com/package/@1claw/cli - npm MCP: https://www.npmjs.com/package/@1claw/mcp - npm OpenAPI Spec: https://www.npmjs.com/package/@1claw/openapi-spec - npm elizaOS plugin: https://www.npmjs.com/package/@1claw/plugin-elizaos - Contact: ops@1claw.xyz ## What 1Claw Does 1Claw stores and manages secrets (API keys, tokens, certificates, private keys, environment variables) in HSM-backed encrypted vaults. AI agents are first-class principals — they authenticate with scoped API keys, receive short-lived JWTs, and access only the secret paths explicitly granted by a human via policies. ## Architecture - **Vault API** (Rust/Axum) at api.1claw.xyz — RESTful API with JWT Bearer auth, HSM-backed signing - **Shroud** (Rust) at shroud.1claw.xyz — TEE-protected LLM proxy + transaction signing (GKE, AMD SEV-SNP) - **Dashboard** (Next.js) at 1claw.xyz — Web UI for humans, includes setup wizards - **MCP Server** (TypeScript) at mcp.1claw.xyz — Model Context Protocol for AI agents - **SDK** (@1claw/sdk) — TypeScript client library - **Wallet React** (@1claw/wallet-react v0.4.1) — Embeddable React treasury widget for Platform API apps. `<OneclawTreasuryWidget />` (Send/Swap/Receive) and `<OneclawEmbeddedWallet />` (social login + full wallet UI). `useOneclawWallet()` exposes `wallets`, `balances`, `send()`, `swap()`, `refresh()`. Social login via `POST /