Shared auth runtime for OpenClaw skills

Go to file

ywkj da16552ad1 revert: remove notify-dependents CI workflow Auth-runtime is infrastructure — cascading updates to all clients x all skills is a business-system concern, not a CI job. Dependent skills will pick up latest auth-runtime next time they are deployed via their install.sh (which always does fresh npm install). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>		2026-03-20 07:09:46 +08:00
dist	fix: createEnvConfig() now calls loadGlobalEnv() + export functional API	2026-03-20 06:42:07 +08:00
src	fix: createEnvConfig() now calls loadGlobalEnv() + export functional API	2026-03-20 06:42:07 +08:00
.gitignore	feat: initial auth-runtime module	2026-03-12 07:33:43 +08:00
README.md	feat: initial auth-runtime module	2026-03-12 07:33:43 +08:00
bun.lock	feat: initial auth-runtime module	2026-03-12 07:33:43 +08:00
install.sh	feat: initial auth-runtime module	2026-03-12 07:33:43 +08:00
package.json	fix: createEnvConfig() now calls loadGlobalEnv() + export functional API	2026-03-20 06:42:07 +08:00
tsconfig.json	feat: initial auth-runtime module	2026-03-12 07:33:43 +08:00

README.md

@clawd/auth-runtime

Shared TypeScript auth runtime for OpenClaw skills.

Features

Token caching with configurable TTL
Automatic token refresh
Session-expired auto retry (401/403)
Environment-based configuration
Type-safe API

Installation

bun add file:../../_shared/auth-runtime

Usage

import {
  createEnvConfig,
  getAccessToken,
  requestApiWithAutoRefresh,
} from '@clawd/auth-runtime';

const config = createEnvConfig();
const token = await getAccessToken(false, config);

const result = await requestApiWithAutoRefresh(
  'POST',
  `${config.authBase}/ecom/tasks/scrape`,
  false,
  config,
  JSON.stringify({ url: 'https://detail.1688.com/offer/123.html' }),
  token,
);

API

Functions

`createEnvConfig(): EnvConfig`

Create configuration from environment variables:

AUTH_BASE: Auth base URL (default: https://api-gw-test.yuanwei-lnc.com)
CLIENT_KEY: Client key (required)
AUTH_CACHE_DIR: Cache directory (default: /tmp/skill-auth-cache)
AUTH_MIN_TTL_SEC: Minimum token TTL in seconds (default: 60)

`getAccessToken(dryRun, config): Promise<string>`

Get access token with caching.

`refreshAccessToken(dryRun, config): Promise<string>`

Refresh access token (bypass cache).

`fetchSessionJson(dryRun, config): Promise<SessionResponse>`

Fetch session JSON from auth endpoint.

`requestApi(method, url, authToken?, body?): Promise<ApiResponse>`

Make HTTP request with optional authorization header.

`isRetryableSessionError(response): boolean`

Check whether response likely indicates expired runtime session.

`requestApiWithAutoRefresh(method, url, dryRun, config, body?, accessToken?): Promise<ApiResponse>`

Call API with one automatic token refresh + retry on session-expired style errors.

Types

`EnvConfig`

Environment configuration.

`SessionResponse`

Session response from auth endpoint.

`CachedTokenData`

Cached token data.

`HttpMethod`

Supported HTTP methods.

`ApiResponse`

HTTP response.

Building

bun run build