Infrastructure Official

OneCLI Gateway

Built-in guidance for making authenticated API calls through OneCLI without exposing credentials to the agent.

What it does

Injects stored credentials at the HTTPS proxy boundary
Works with standard HTTP clients such as curl and fetch
Keeps credential values out of agent prompts and files
Uses connection links when an external app is not connected
Honors per-agent gateway policies

What you'll need

NanoClaw installed and running
OneCLI Agent Vault initialized

Availability

Built into every agent container

Every NanoClaw agent container includes the onecli-gateway skill. It teaches the agent to call external APIs normally while the OneCLI gateway injects credentials after the request leaves the container. If an app is not connected, the gateway returns a connection link for the user.

This is a built-in instruction skill. The NanoClaw setup flow configures the proxy and vault; there is no separate skill command to run inside the agent.

Read the current source skill for the exact request and failure-handling rules.