ClaWallet

Give your OpenClaw agent the ability to request crypto card payments. The agent signs a payment intent with its WDK identity, the owner approves via their wallet in the dashboard, and funds go to the linked card.

How It Works

1. Agent calls clawallet_request_payment with an amount and reason
2. The plugin signs the intent with the agent's local WDK wallet (identity only -- no funds)
3. Backend creates a pending approval and returns an approval URL
4. Owner opens the URL, reviews the request, and approves via their wallet
5. Funds move from the owner's wallet to the crypto card
6. Agent polls clawallet_payment_status to confirm

The agent never holds or moves funds. The owner controls everything.

Installation

openclaw plugins install @clawallet/clawallet.xyz

Configuration

Enable the plugin in ~/.openclaw/.openclaw.json5:

{
  plugins: {
    entries: {
      "clawallet.xyz": {
        enabled: true,
        config: {
          serverBaseUrl: "https://api.clawallet.xyz",
        },
      },
    },
  },
}

Per-Agent Setup

Each agent gets its own API key and identity wallet. Use the agent ID to configure:

openclaw clawallet configure <apiKey> --agent trading-bot
openclaw clawallet configure <apiKey> --agent assistant

Each agent's credentials are stored separately under ~/.openclaw/clawallet/agents/<id>/.

Single Agent

Without --agent, the plugin uses the default identity:

openclaw clawallet configure <apiKey>

View All Agents

openclaw clawallet list

Output:

Configured agent(s):

  default
    Wallet: 0xabc...
    Server: https://api.clawallet.xyz
  trading-bot
    Wallet: 0xdef...
    Server: https://api.clawallet.xyz

Configure another agent:
  openclaw clawallet configure <apiKey> --agent <id>

Tools

| Tool | Description | | --- | --- | | clawallet_request_payment | Request a payment (signs intent, returns approval URL) | | clawallet_payment_status | Check if the owner has approved/funded a request |

CLI Commands

openclaw clawallet configure <apiKey> [--agent <id>]   # Set up API key + generate identity
openclaw clawallet status [--agent <id>]               # Show current configuration
openclaw clawallet disconnect [--agent <id>]           # Remove saved credentials and wallet
openclaw clawallet list                                # Show all configured agents

Error Codes

| Code | Description | | --- | --- | | NOT_CONFIGURED | API key not set. Run openclaw clawallet configure | | UNAUTHORIZED | Invalid or revoked API key | | FORBIDDEN | Action not allowed | | NO_CARD | No crypto card linked. Owner must link one in the dashboard | | INVALID_AMOUNT | Amount must be a positive number under 1,000,000 | | NETWORK_ERROR | Could not reach the ClaWallet server | | TIMEOUT | Request timed out | | API_ERROR | Unexpected server error |

Security

• The agent wallet is identity only -- it signs intents but never holds funds
• Each agent has its own isolated wallet and API key
• The seed phrase is encrypted with AES-256-GCM, keyed from the API key via PBKDF2
• WDK dispose() is called after every signing operation to wipe keys from memory
• Config files are stored with 0600 permissions
• All communication uses HTTPS (localhost exempt for development)

Local Storage

~/.openclaw/clawallet/
  clawallet.json              # default agent
  agents/
    trading-bot/
      clawallet.json          # per-agent config
    assistant/
      clawallet.json

Built With

• Tether WDK -- self-custodial wallet toolkit
• OpenClaw Plugin SDK

License

MIT