Claude Skill MartBrowse skillsWhat is a Skill?
 
← Back to list

Use Native Credential Proxy (NanoClaw)

Opt NanoClaw out of the OneCLI gateway and inject Anthropic credentials straight from .env into the container.

Dev & CodingIntermediate★ 30,471⑂ 12,865AI score 7/10Last updated: Aug 9, 2026

What it does

By default NanoClaw keeps Anthropic credentials in the OneCLI agent vault and injects them per request through an HTTPS proxy. This skill deliberately opts out: it reads ANTHROPIC_API_KEY / CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_AUTH_TOKEN (plus optional ANTHROPIC_BASE_URL) from .env and passes them into the container as Docker -e arguments, which the Claude Agent SDK reads natively. No vault, no proxy, no certificates.

The change is additive: it copies native-credential-proxy.ts and two test files into src/, then makes a single one-line reach-in — args.push(...nativeCredentialEnvArgs()) right after the TZ env line in buildContainerArgs (src/container-runner.ts). All gating lives inside the function, so with NANOCLAW_NATIVE_CREDENTIALS unset it is a complete no-op and the OneCLI path is untouched.

The doc is organized into four phases — pre-flight, code changes, credential configuration, restart & verify — plus troubleshooting and a removal guide (REMOVE.md).

Who it's for

  • Developers self-hosting NanoClaw who want to get running without standing up the OneCLI vault
  • Users who already have a Claude Pro/Max token (claude setup-token) or a console API key
  • Teams that need a custom endpoint via ANTHROPIC_BASE_URL
  • Not for you if you can't accept credentials living in container environment variables (shared or multi-tenant hosts).

Examples

  1. Switch to a subscription token — ask it to "apply the native credential proxy with my Claude Max subscription"; it walks you through claude setup-token in a separate terminal and writes NANOCLAW_NATIVE_CREDENTIALS=true plus the token into .env without collecting the secret in chat.
  2. Configure an API key — drop a console.anthropic.com key into .env, then run the build and both vitest suites (behavior + wiring) to prove the .env → -e injection path works.
  3. Roll back to OneCLI — ask for removal and it follows REMOVE.md: delete the copied files, strip the reach-in and import, clean the .env keys, restart the service.

· · · Install guide · · ·

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the .claude/skills/use-native-credential-proxy folder from the GitHub repo nanocoai/nanoclaw into my ~/.claude/skills/use-native-credential-proxy/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/nanocoai/nanoclaw.git && mkdir -p ~/.claude/skills && cp -r nanoclaw/.claude/skills/use-native-credential-proxy ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal. This skill operates inside a NanoClaw checkout, so have your NanoClaw project folder ready.
  2. To install just the skill for Claude Code, run: 
    git clone https://github.com/nanocoai/nanoclaw.git && mkdir -p ~/.claude/skills && cp -r nanoclaw/.claude/skills/use-native-credential-proxy ~/.claude/skills/
  3. Change into your NanoClaw project root (cd nanoclaw) and start Claude Code there.
  4. Ask Claude: "use the use-native-credential-proxy skill to switch to .env-based credentials." It runs the pre-flight check, copies the files, and makes the single-line edit in container-runner.ts.
  5. Answer the credential question: for a subscription, run claude setup-token in another terminal; for pay-per-use, create a key at console.anthropic.com/settings/keys. Paste the secret into .env yourself rather than into the chat.
  6. Confirm pnpm run build and pnpm exec vitest run src/native-credential-proxy.test.ts src/native-credential-proxy-wiring.test.ts both pass.
  7. Restart the service (macOS: launchctl kickstart; Linux: systemctl --user restart; otherwise bash start-nanoclaw.sh), then send a test message in a registered chat to verify the agent replies.
  8. To undo everything, have Claude follow REMOVE.md in the skill folder.
View source on GitHub ↗License: MIT