auth-manager

Auth Manager v4.0 — Platform Login-State Management

Uniformly use the OpenClaw built-in browser (profile=openclaw), all platforms share the same Chrome profile. ⚠️ Use of fbu / fast-browser-use is prohibited, deprecated.

Architecture — Single Profile Model

~/.openclaw/browser/openclaw/user-data/   ← 唯一的 Chrome profile（内置 browser）
~/.openclaw/auth-platforms.json           ← 平台配置
~/.openclaw/auth-session-state.json       ← 检查结果状态

Why unify?

• All agents (quant/ops/main, etc.) share the same browser profile
• Log in once, available everywhere. There's no such problem as \"this agent isn't logged in\"
• OAuth chained login (e.g. Provider-A depends on GitHub) is inherited automatically

Core Responsibilities

Responsibility 1: Check Login State (scheduled cron)

Priority: curl/CLI > built-in browser

Method A: curl/CLI check (fast, low resource usage)

# GitHub — 最可靠
gh auth status 2>&1

# AIXN — curl API
TOKEN=$(python3 -c "import json; print(json.load(open('/home/aa/.openclaw/chrome-profiles/provider-session.json')).get('token',''))" 2>/dev/null)
curl -s --max-time 10 'https://ai.9w7.cn/api/user/info' -H "Authorization: Bearer $TOKEN"

# Provider-A — curl
COOKIE=$(python3 -c "import json; print(json.load(open('/home/aa/.openclaw/chrome-profiles/your-provider-session.json')).get('cookie',''))" 2>/dev/null)
curl -s --max-time 10 'https://your-provider.example.com/api/user/info' -H "Cookie: $COOKIE"

Method B: built-in browser check (for sites requiring rendering)

# 导航到目标页面
browser(action='navigate', targetUrl='<check_url>', profile='openclaw')

# 等待加载后截取快照
browser(action='snapshot', compact=true, maxChars=2000, profile='openclaw')

Applicable platforms: Polymarket, LinuxDo, X, Douyin, Xiaohongshu

Judgment logic:

• Snapshot contains the logged_in_indicators keyword → ✅ active
• Snapshot contains the login_page_indicators keyword → ❌ expired
• Timeout/network error → ⚠️ error(not expired! distinguish clearly)

Responsibility 2: New Platform Authorization

When you need to log in to a new platform:

# 1. 用内置 browser 打开登录页
browser(action='navigate', targetUrl='https://platform.com/login', profile='openclaw')

# 2. 截图给用户确认页面
browser(action='screenshot', profile='openclaw')

# 3. 如果需要用户操作（扫码等），等待用户确认后再 snapshot 验证
browser(action='snapshot', compact=true, profile='openclaw')

After a successful login, cookie/localStorage/IndexedDB are automatically saved in ~/.openclaw/browser/openclaw/user-data/。

Responsibility 3: Other agents using the login state

All agents automatically inherit the login state when calling the built-in browser:

# quant agent 访问 polymarket — 自动已登录
browser(action='navigate', targetUrl='https://polymarket.com', profile='openclaw')

# ops agent 检查 github — 自动已登录
browser(action='navigate', targetUrl='https://github.com', profile='openclaw')

No additional configuration is needed. profile=openclaw is shared.

Platform Configuration

~/.openclaw/auth-platforms.json:

{
  "platforms": {
    "platform_id": {
      "name": "显示名称",
      "check_url": "https://example.com/dashboard",
      "login_url": "https://example.com/login",
      "check_method": "browser|curl|cli",
      "logged_in_indicators": ["关键词1", "关键词2"],
      "login_page_indicators": ["登录", "Sign in"],
      "enabled": true
    }
  }
}

Known Platform Characteristics (9)

Platform	Check Method	Login Method	Account	Notes
GitHub	gh auth status (CLI)	Password/OAuth	aAAaqwq	Most reliable
AIXN	curl API	Password	2067089451@qq.com	session.json token
Provider-A	curl API	GitHub OAuth	github_210817	Depends on GitHub login state
Polymarket	Built-in browser	Wallet/OAuth	Portfolio $41.62	Check for the \"portfolio\" keyword
LinuxDo	Built-in browser	Password/OAuth	aaqwqaa68	Cloudflare site
X (Twitter)	Built-in browser	Password	@Daniel_Li666	May have CAPTCHA
Xiaohongshu	Built-in browser	App QR code scan/phone number	69464fc5...	check: xiaohongshu.com/user/profile/me
Reddit	Built-in browser	Password/OAuth	Jealous-Carrot-9574	reCAPTCHA requires manual passing
Douyin Creator	Built-in browser	App QR code scan	aa (61747337251)	check: creator.douyin.com/creator-micro/home

Status File Format

~/.openclaw/auth-session-state.json:

{
  "checkedAt": "2026-03-07T09:00:00+08:00",
  "platforms": {
    "github": { "status": "active", "account": "aAAaqwq", "method": "cli" },
    "polymarket": { "status": "active", "detail": "Portfolio $41.56", "method": "browser" }
  }
}

status values: active | expired | error

Cron Tasks

• Auth check cron: 1f2eb5a5 — runs daily at 09:00/21:00
• If expired, push an alert to the DailyNews group
• If all normal, stay silent

Iron Rules ⚠️

1. Use of fbu / fast-browser-use is prohibited — deprecated
2. Uniformly use profile='openclaw' — for all browser operations
3. Old profile directory ~/.openclaw/chrome-profiles/<platform>/ is deprecated, keep only session.json for curl to read token/cookie
4. Timeout ≠ expired — network issues are marked as error, not as expired
5. Each check takes at most 15 seconds — to avoid blocking

Migration notes (v3 → v4)

• Old version: each platform had its own fbu Chrome profile (~/.openclaw/chrome-profiles/<platform>/)
• New version: all platforms share the built-in browser profile (~/.openclaw/browser/openclaw/user-data/)
• The built-in browser already has IndexedDB/cookie data for all platforms; no manual migration is needed
• Old chrome-profiles/ directory was completely deleted on 2026-03-07 (freeing ~1.7GB)
• Old <platform>-session.json file has also been deleted (token has expired)