Current state: API v1 auth is POST /api/v1/auth/login → signed bearer token with a 30-day TTL, tied to the user session (and TOTP if enabled). There is no long-lived, revocable, scoped key — an external agent (OpenClaw) would have to hold the user password/credentials or re-auth on expiry.
Want: a dedicated API token mechanism (e.g., stored as a Setting key/value) that:
- is issued independently of the user password (no TOTP dependency for the agent),
- is long-lived / not tied to a 30-day session,
- is revocable without logging the user out,
- is scopable (e.g., read people + read overdue check-ins + write journal + mark-contacted; explicitly NOT account-delete/settings/admin).
API surface: e.g. GET/POST/DELETE /api/v1/auth/tokens and/or a small Settings UI.
Current state: API v1 auth is
POST /api/v1/auth/login→ signed bearer token with a 30-day TTL, tied to the user session (and TOTP if enabled). There is no long-lived, revocable, scoped key — an external agent (OpenClaw) would have to hold the user password/credentials or re-auth on expiry.Want: a dedicated API token mechanism (e.g., stored as a
Settingkey/value) that:API surface: e.g.
GET/POST/DELETE /api/v1/auth/tokensand/or a small Settings UI.