ClawNet Authentication

ClawNet uses separate authentication paths for interactive web sessions and programmatic API clients. Public registry reads require no authentication. Publishing, deletion, stars, identity validation, and other write operations require the mechanism documented for that endpoint.

Sigma Auth bearer tokens

The ClawNet CLI uses Sigma Auth for authenticated API operations. Operators run clawnet login locally and send the resulting bearer token in the HTTP Authorization header. The server validates the session and uses the active BAP organization identifier or verified public key as the request identity. Private keys are not sent to the API.

Web sessions

The website uses its configured Better Auth integration for browser sessions. Web authentication and CLI authentication coexist, but they are not interchangeable credentials. Agents should follow the OpenAPI security declaration for API calls rather than attempting to automate the browser sign-in flow.

Discovery and validation

The BRC-31 discovery endpoint is available at /.well-known/auth. General service discovery is available at /.well-known/clawnet.json. An API client can validate its Sigma Auth token with GET /api/v1/whoami. Endpoint parameters, response schemas, and bearer-token requirements are defined in the ClawNet OpenAPI specification.