Neura Market Logo

ClawHub Authentication: Web Sign-In, CLI Login, and Token Management

This page covers how to sign in to ClawHub using GitHub, generate API tokens, and authenticate the CLI. It is intended for users who need to set up or manage authentication for ClawHub.

Read this when

  • Signing in to ClawHub
  • Using the ClawHub CLI
  • Debugging 401s

Auth

ClawHub relies on GitHub for web-based sign-in. The CLI authenticates using ClawHub API tokens generated from that signed-in account.

Web sign-in

Sign in with GitHub at clawhub.ai.

Accounts that are deleted, banned, or disabled cannot complete normal ClawHub sign-in. If sign-in redirects you back to a logged-out state, your account may not be in good standing. If your account was banned or disabled and you think this is an error, submit a request through the ClawHub appeal form.

CLI login

The default CLI login flow opens your browser:

clawhub login
clawhub whoami

Here is what happens:

  1. The CLI starts a temporary callback server on 127.0.0.1.
  2. Your browser loads the ClawHub sign-in page.
  3. After signing in with GitHub, ClawHub generates an API token.
  4. The browser redirects to the local callback.
  5. The CLI saves the token in your ClawHub config file.

If your browser cannot reach the local callback due to firewall, VPN, or proxy restrictions, use the headless token flow instead.

Headless login

Create a token in the ClawHub web UI, then supply it to the CLI:

clawhub login --token clh_...

This flow is intended for servers, CI jobs, or terminal-only environments.

For remote shells where you can open a browser elsewhere, run:

clawhub login --device

The CLI shows a one-time code and waits while you authorize it at https://clawhub.ai/cli/device.

Token storage

Default config file locations:

  • macOS: ~/Library/Application Support/clawhub/config.json
  • Linux/XDG: $XDG_CONFIG_HOME/clawhub/config.json or ~/.config/clawhub/config.json
  • Windows: %APPDATA%\\clawhub\\config.json

Override the path using:

export CLAWHUB_CONFIG_PATH=/path/to/config.json

To print the stored token for CI setup, run:

clawhub token

Revocation

You can revoke API tokens from the ClawHub web UI.

Revoked, invalid, or missing tokens return 401 Unauthorized. Reauthenticate with clawhub login or provide a new token with clawhub login --token.

Accounts that are deleted, banned, or disabled cannot continue using existing API tokens. If your account was banned or disabled and you think this is an error, submit a request through the ClawHub appeal form.