Native Credential Proxy

How it works

NanoClaw’s default is that credentials live in the OneCLI agent vault and are injected per request — the container never sees a raw key threaded in via -e. The /use-native-credential-proxy skill deliberately inverts that. The credential lives in .env on your host and is passed directly into the container’s environment, where the Claude Agent SDK reads it natively. No vault, no HTTPS proxy, no certificates. That inversion is the entire point of the skill: simple .env-based credentials for users who don’t want to run OneCLI.

The skill is additive. It copies src/native-credential-proxy.ts into your project, which exports nativeCredentialEnvArgs(). That function reads ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, or CLAUDE_CODE_OAUTH_TOKEN (plus an optional ANTHROPIC_BASE_URL) from .env and returns the Docker -e VAR=value arguments. All the gating lives inside that function — it returns an empty array unless NANOCLAW_NATIVE_CREDENTIALS=true.

Because the gate is internal, wiring it into core is a single unconditional line. The reach-in goes into buildContainerArgs in src/container-runner.ts, right after the TZ env line, where the container’s env vars are assembled and just before the OneCLI gateway is applied. With the flag on, the direct credential env vars take precedence; with it off, nothing changes and the OneCLI path behaves exactly as before.

Setup

The skill runs in phases. It first checks whether the proxy is already wired and confirms the container-spawn seam exists. It then copies its source and two tests into src/, adds the import to src/container-runner.ts, makes the one-line reach-in, and appends the flag stub to .env.example. It validates with a clean build and both tests:

pnpm run build
pnpm exec vitest run src/native-credential-proxy.test.ts src/native-credential-proxy-wiring.test.ts

Next it asks which credential you want to use — a Claude Pro/Max subscription or an Anthropic API key. For the subscription path, you run claude setup-token in another terminal and paste the token into .env as CLAUDE_CODE_OAUTH_TOKEN (never in chat). For the API key path, you add ANTHROPIC_API_KEY from console.anthropic.com. Either way the skill sets NANOCLAW_NATIVE_CREDENTIALS=true. Finally it restarts the service and verifies by sending a test message in a registered chat.

Tips

• This is an opt-out. Everywhere else in NanoClaw, env-threaded credentials are an anti-pattern — use this skill only if you accept that tradeoff in exchange for skipping OneCLI.
• The behavior test drives nativeCredentialEnvArgs() against a real .env read; the wiring test asserts the reach-in exists inside buildContainerArgs. Delete the reach-in and it goes red.
• For a custom API endpoint, add ANTHROPIC_BASE_URL to .env. It is forwarded into the container when present and defaults to https://api.anthropic.com.
• If the agent still routes through OneCLI, confirm NANOCLAW_NATIVE_CREDENTIALS=true is in .env and that you restarted the service. With the flag unset, the function is a no-op and OneCLI stays the credential source.
• On a 401, the credential is invalid or expired — re-run claude setup-token for a subscription token, or recheck the key at console.anthropic.com.
• To reverse the change, REMOVE.md deletes the copied files, removes the reach-in and import, strips the .env keys, and restarts.