Integrations

Every service your agents touch, gated in one place.

Connect the accounts your agents need — email, calendar, code, chat — and Clawvisor brokers every request. The same purpose verification, credential vaulting, and audit trail apply to each one, from Gmail and GitHub to your own internal APIs.

Credential vault

Add any key or secret. Agents use it, never see it.

Anything an agent needs to authenticate goes in the vault: API keys, OAuth tokens, database passwords, SSH keys, webhook signing secrets, even your own internal service tokens. Clawvisor stores each one encrypted and hands the agent nothing in its place. The agent asks for a service and an action; the gateway attaches the credential.

01

Add the secret once

Paste an API key or connect a tool via OAuth. It's encrypted in the vault the moment it lands, and nothing else ever needs a copy.

02

The agent gets a handle

Not the key: an opaque, scoped, short-lived pointer that's useless on its own and outside the task it was issued for.

03

Injected at call time

When an approved call goes out, the gateway attaches the real secret at the edge, so it never enters the model's context, the tool transcript, or your logs.

04

Rotate anytime

Rotate or revoke the underlying secret in the vault and every handle keeps working. There's no agent code or config to touch.

Credentials

Agents never hold your secrets.

The agent never receives a credential at all, not even a pointer to one. It names the service and the action it needs, and Clawvisor attaches the real token inside the gateway on an approved call. Go ahead: reveal it. Your agent has no way to.

What the agent sends

no credential
POST /api/gateway/request

{ "service": "github",
  "action":  "create_issue",
  "task_id": "t_4821" }

A service and an action. No key, and nothing that stands in for one, so there is nothing here worth stealing.

Clawvisor attaches

The real GitHub API key

vaulted
ghp_Rk8f2Kd9mPq2RxN4vTb7Lc3Wj••••••••••

Stored in the vault. Attached inside the gateway on an approved call, then stripped from the result.

Put a gateway in front of every tool.

Run the gateway yourself, or take the managed deployment with org accounts and longer retention.