ClawHub Authentication: Web Sign-In, CLI Login, and Token Management
Learn how to sign in to ClawHub via GitHub, generate and manage API tokens, and use the CLI for login. This guide covers web sign-in, CLI login flows, headless token generation, and token storage and revocation.
Read this when
- Signing in to ClawHub
- Using the ClawHub CLI
- Debugging 401s
Auth
Web sign-in on ClawHub is handled through GitHub. API tokens generated from that authenticated account are what the CLI uses.
Web sign-in
Head over to clawhub.ai and sign in with your GitHub credentials.
Signing in normally is not possible for accounts that have been deleted, banned, or disabled. If the sign-in process returns you to a logged-out state, your account might not be in good standing. If you think your account was banned or disabled in error, submit an appeal via the ClawHub appeal form.
CLI login
The default CLI login flow launches your browser:
clawhub login
clawhub whoami
Here is how it works:
- A temporary callback server is started by the CLI on
127.0.0.1. - The ClawHub sign-in page opens in your browser.
- Once you sign in through GitHub, an API token is generated by ClawHub.
- The browser redirects to the local callback.
- The token gets saved by the CLI into your ClawHub config file.
If firewall, VPN, or proxy rules prevent your browser from reaching the local callback, switch to the headless token flow instead.
Headless login
Generate a token from the ClawHub web UI, then supply it to the CLI:
clawhub login --token clh_...
This flow is intended for servers, CI jobs, or environments limited to a terminal.
For remote shells where a browser can be opened elsewhere, execute:
clawhub login --device
A one-time code is printed by the CLI, and it waits while you authorize that code at https://clawhub.ai/cli/device.
Token storage
Default config file locations:
- macOS:
~/Library/Application Support/clawhub/config.json - Linux/XDG:
$XDG_CONFIG_HOME/clawhub/config.jsonor~/.config/clawhub/config.json - Windows:
%APPDATA%\\clawhub\\config.json
To override the path, use:
export CLAWHUB_CONFIG_PATH=/path/to/config.json
To print the stored token for CI configuration, run:
clawhub token
Revocation
API tokens can be revoked through the ClawHub web UI.
A token that has been revoked, is invalid, or is missing results in 401 Unauthorized. Reauthenticate with clawhub login or provide a new token using clawhub login --token.
Existing API tokens cannot be used by accounts that have been deleted, banned, or disabled. If you believe your account was banned or disabled incorrectly, use the ClawHub appeal form to file an appeal.