← back
Claws Out: Securing and Building with OpenClaw - Nick Taylor, Pomerium
Takeaway
Correctly configured identity-aware proxying can simplify OpenClaw access while explicit permissions remain essential for agent actions.
Summary
- Nick Taylor contributed OpenClaw's trusted-proxy authentication mode to support an identity-aware proxy combining authentication, policy enforcement, and reverse proxying.
- Configuration specifies trusted proxy addresses and identity headers, allowing proxy-authenticated WebSocket access without the prior token-entry and device-pairing steps.
- A missed fresh-device scenario led to a community bug fix, illustrating the need to test more than an already-paired local environment.
- The talk also shows personal tools built through OpenClaw, including a workspace editor and an MCP app, and recounts an agent publishing a PR before review after receiving broad GitHub access.
openclawidentity-aware-proxyauthentication
Original description
Running OpenClaw without hardening access to it is a bad idea. We'll cover how I secured my OpenClaw, McClaw, contributed trusted-proxy auth mode to the OpenClaw project, and how I use it to build tools. We're going to build something live during the talk using OpenClaw, the same way I built Clawspace, a browser-based file explorer/editor for your OpenClaw workspace. feat(gateway): add trusted-proxy auth modegiithub.com/nickytonline/clawspace, a browser-based file explorer/editor for an OpenClaw workspace.github.com/pomerium/pomerium, an open core Identity-Aware Proxy