Summary

Request for native integration with secrets management tools like Doppler, 1Password, HashiCorp Vault, or similar - instead of relying on .env files and JSON configs for sensitive credentials.

Problem

Currently, API keys and secrets are stored in:

• .env files (plaintext on disk)
• openclaw.json config (plaintext on disk)
• Environment variables

This is insecure because:

• Secrets are visible in plaintext files
• Easy to accidentally commit to git
• No audit trail for secret access
• No automatic rotation
• Difficult to manage across multiple environments

Proposed Solution

Native integration with secrets managers:

Tier 1 (Most Requested)

• Doppler - Popular for CLI/server environments
• 1Password CLI - Common for personal/team use
• Bitwarden CLI - Open source alternative

Tier 2

• HashiCorp Vault - Enterprise standard
• AWS Secrets Manager
• macOS Keychain - Already on every Mac

Proposed Config

{
  "secrets": {
    "provider": "doppler",
    "doppler": {
      "project": "openclaw",
      "config": "dev"
    },
    "mapping": {
      "ANTHROPIC_API_KEY": "anthropic.apiKey",
      "ELEVENLABS_API_KEY": "messages.tts.elevenlabs.apiKey",
      "TELEGRAM_BOT_TOKEN": "channels.telegram.botToken"
    }
  }
}

Benefits

1. Security - Secrets never stored in plaintext files
2. Audit trail - Know who accessed what and when
3. Rotation - Easy secret rotation without config changes
4. Environment management - Dev/staging/prod secrets separated
5. Team sharing - Secure secret sharing without sending keys in chat

Current Workaround

Using Doppler CLI manually:

ELEVENLABS_API_KEY=$(doppler secrets get ELEVENLABS_API_KEY --plain) openclaw gateway start

This works but requires manual setup and doesn't integrate with OpenClaw's config system.

Filed via Wiwi 🦊 on behalf of @realsamrat