@lifeaitools/clauth

Hardware-bound credential vault for the LIFEAI stack. Your machine is the second factor. Keys live in Supabase Vault (AES-256). Nothing sensitive ever touches a config file.

Install

npm install -g @lifeaitools/clauth

Then provision your Supabase project:

clauth install

That's it. clauth install handles everything:

• Creates all database tables
• Deploys the auth-vault Edge Function
• Generates HMAC salt + bootstrap token
• Tests the connection end-to-end
• Installs the Claude skill

At the end it prints a bootstrap token — save it for the next step.

After Install — Register Your Machine

clauth setup

Prompts for: machine label, password, bootstrap token (from clauth install).

Then verify:

clauth test      # → PASS
clauth status    # → 12 services, all NO KEY

What clauth install asks for

Two things from Supabase:

1. Project ref — the last segment of your Supabase project URL: https://supabase.com/dashboard/project/ your-ref-here

2. Personal Access Token (PAT): https://supabase.com/dashboard/account/tokens → Generate new token

This is not your anon key or service_role key — it is your account-level token.

Writing Your First Key

clauth write key github     # prompts for value
clauth enable github
clauth get github

Command Reference

clauth install              Provision Supabase + install Claude skill
clauth setup                Register this machine with the vault
clauth status               All services + state
clauth test                 Verify connection

clauth write key <service>  Store a credential
clauth write pw             Change password
clauth enable <svc|all>     Activate service
clauth disable <svc|all>    Suspend service
clauth get <service>        Retrieve a key

clauth add service <n>      Register new service
clauth remove service <n>   Remove service
clauth revoke <svc|all>     Delete key (destructive)

Built-in Services

github supabase-anon supabase-service supabase-db vercel namecheap neo4j anthropic r2 r2-bucket cloudflare rocketreach

How It Works

Machine fingerprint (BIOS UUID + OS install ID)
  + Your clauth password
  → HMAC-SHA256 token + 5-min timestamp window
  → Supabase Edge Function validates
  → Returns AES-256 encrypted key from Vault

Nothing stored locally. Password never persisted. Machine hash is one-way only.

Releasing a New Version (maintainers)

# 1. Bump version in package.json
# 2. Commit and tag
git tag v0.1.1
git push --tags
# GitHub Actions publishes automatically via Trusted Publishing

Life before Profits. — LIFEAI / PRT

☕ Support this project