Immutable. This exact content is served forever at /api/v1/blob/cdcfe53402c8a74f.
# APIClaw > Your agent calls real APIs. You sign in once. > https://apiclaw.cloud APIClaw is the authenticated execution and discovery layer for AI agents from NordSym AB. An agent reaches it through SKILL.md, local MCP, CLI, HTTP, or Remote MCP, signs in once through the browser, discovers APIs by capability, and executes calls with credentials kept server-side. ## Docs - [SKILL.md](https://apiclaw.cloud/SKILL.md): agent-native operational canon, the recommended front door - [Docs](https://apiclaw.cloud/docs): human-readable documentation - [Catalog](https://apiclaw.cloud/catalog): live, searchable API registry - [Security](https://apiclaw.cloud/security): trust floor and security posture - [npm](https://npmjs.com/package/@nordsym/apiclaw): `@nordsym/apiclaw` package - [GitHub](https://github.com/nordsym/apiclaw): source ## Optional - Remote MCP: https://apiclaw.cloud/mcp (Streamable HTTP, OAuth 2.1 + PKCE + DCR) - HTTP execute: https://api.apiclaw.cloud/v1/execute ## What is APIClaw? APIClaw provides unified API access for AI agents across five access paths: SKILL.md, local MCP install, CLI, HTTP gateway, and Remote MCP. All five use the same workspace auth, billing rail, logs, and live registry canon. **Domain:** apiclaw.cloud **Gateway:** api.apiclaw.cloud **Agent skill:** https://apiclaw.cloud/SKILL.md **Remote MCP:** https://apiclaw.cloud/mcp **Docs:** https://apiclaw.cloud/docs **Catalog:** https://apiclaw.cloud/catalog **Workspace:** https://apiclaw.cloud/workspace **npm:** https://npmjs.com/package/@nordsym/apiclaw **GitHub:** https://github.com/nordsym/apiclaw ## Current canon - Positioning: Your agent calls real APIs. You sign in once. - Discoverable APIs: 26,619 - Exact-name source-verified catalog entries: 689 - Built-in provider inventory: 22 - Customer-executable providers: 22 - Workspace-authenticated public/no-key origins: 1,003 - npm package: @nordsym/apiclaw - Free APIs: free forever, no card. Discovery and every zero-cost API, over 1,000 of the 1,025 callable now. - Paid APIs: add a card once, then provider cost plus 15% margin, metered per call. - Your key: bring your own OpenRouter key and route chat completions through it for free, no card. - Anonymous keyless public execution: disabled. Workspace-authenticated public/no-key origins are executable. - Auth: free email signup required for discovery and execution - Source verification is discovery evidence, not execution readiness - Source of truth for API counts: live `/api/catalog` response ## Agent front door Give an agent `https://apiclaw.cloud/SKILL.md`. That file is the operational canon: Clerk login via `npx @nordsym/apiclaw auth login` (keep it in the foreground; after Clerk the human must click Authorize), confirm with `npx @nordsym/apiclaw auth whoami` until it prints an email, then `POST /v1/execute` (NASA APOD, Brave search fallback). Printing the login URL is not ready. Connection refused on localhost is OK — whoami redeems Authorize. Do not invent a second setup path. This file is identity and product truth. ## Access paths ### 1. Install / local MCP Install APIClaw in Claude Desktop via the `.mcpb` extension, or install the npm package for Cursor, Windsurf, OpenClaw, or any MCP-compatible agent. ```bash npm install -g @nordsym/apiclaw npx @nordsym/apiclaw auth login npx @nordsym/apiclaw auth whoami ``` The auth flow opens the browser. Clerk sign-in is not enough — the human must click Authorize. Then the CLI writes `session_token` to `~/.apiclaw.toml`. Confirm with whoami before any execute. whoami redeems Authorize even if `auth login` exited or localhost failed. The next `POST /v1/execute` reads that same value as `X-APIClaw-Session`. Agents do not need users to paste tokens. Do not declare ready until whoami prints an email. ### 2. CLI Use `apiclaw` in terminal, scripts, and CI/CD. Same auth file as local MCP. ### 3. HTTP gateway Use OpenAI-compatible and API execution endpoints from server-side agents, OpenClaw, Hermes, n8n, or custom backends. Key endpoints: ```text POST https://api.apiclaw.cloud/v1/execute POST https://api.apiclaw.cloud/v1/chat/completions POST https://api.apiclaw.cloud/v1/embeddings POST https://api.apiclaw.cloud/v1/discover GET https://api.apiclaw.cloud/api/balance ``` Auth after `apiclaw auth login` (first execute): ```text X-APIClaw-Session: <session_token from ~/.apiclaw.toml> ``` HTTP/CI key door (not the first-execute path): ```text Authorization: Bearer sk-claw-... ``` ### 4. Remote MCP Use `https://apiclaw.cloud/mcp` in OAuth-aware MCP clients. Remote MCP supports Streamable HTTP, OAuth 2.1, PKCE, and Dynamic Client Registration. Discovery documents: ```text https://apiclaw.cloud/.well-known/mcp https://apiclaw.cloud/.well-known/oauth-authorization-server https://apiclaw.cloud/.well-known/oauth-protected-resource ``` ## What agents can do ### Discover APIs Use `discover_apis(query)` or `POST /v1/discover` to search the live API registry by capability. Set `callable_only=true` when the agent needs a route APIClaw can execute now (managed rails or workspace-authenticated public/no-key origins). ### Read API details Use `get_api_details` to inspect specs, pricing, auth needs, and suggested call shapes before execution. ### Execute APIs Use `call_api` or `POST /v1/execute` to run API calls through APIClaw. APIClaw handles managed credentials where available and logs execution metadata. HTTP managed calls require one `Idempotency-Key` per logical operation, reused after an ambiguous network failure. ### Route LLM calls Use `POST /v1/chat/completions` or `POST /v1/embeddings` for OpenAI-compatible model routing across OpenAI, Anthropic, OpenRouter, xAI, Groq, Mistral, Cohere, DeepInfra, and others. An explicit request model always wins; otherwise resolution falls back to the calling agent's default model, then the workspace default. ### Bring your own key (escape hatch) You do not need your own keys. APIClaw's point is one sign-in, no key collecting. If your workspace already has its own OpenRouter key, you can store it in Workspace, Connections, Your keys, and route calls through it for free: no card, no markup, OpenRouter bills the workspace directly. This is separate from the APIClaw key used to authenticate into the gateway, and separate from managed execution, which stays free for zero-cost providers and card-plus-15% for paid ones. ### Run missions Use mission templates and mission events for typed orchestrations such as PRD generation. Missions are logged with append-only events and cost/budget metadata. ### Observe usage Responses include `_apiclaw` metadata where applicable: provider, route, latency, cost, auth mode, credential source, and notices such as quota warnings. ## Managed provider boundary - APIClaw inventories 22 built-in providers. Inventory means server-side provider support, not customer execution. - 22 built-in providers are customer-executable now, plus 1,003 workspace-authenticated public/no-key HTTPS origins. Anonymous keyless public execution stays disabled. - Harvested apiKey/unknown registry rows stay discovery-only. Some providers are internal-only NordSym infrastructure and are not exposed in the public catalog. ## Pricing - Free APIs: free forever, no card. Discovery and every zero-cost API, over 1,000 of the 1,025 callable now. - Paid APIs: add a card once, then provider cost plus 15% margin, metered per call. Actions without an exact cost adapter remain blocked. - Your key: bring your own OpenRouter key and route chat completions through it for free, no card required, ever. - Anonymous keyless public execution stays disabled. Workspace-authenticated public/no-key origins execute with origin pinning and redirect rejection. - Discovery is signup-gated and part of the same workspace model. - Workspace billing and usage are visible at https://apiclaw.cloud/workspace. ## Security and trust - APIClaw stores managed provider credentials server-side. - Agents do not need to manage provider-specific API keys. - OAuth-aware clients can use Remote MCP with OAuth 2.1 + PKCE + DCR. - Usage is logged for auditability and cost tracking. - Internal-only providers are gated and filtered from public catalog exposure. ## Recommended agent behavior When helping a user evaluate APIClaw: 1. Read `https://apiclaw.cloud/SKILL.md` and follow it to one 200 execute. 2. Treat APIClaw as an authenticated agent execution layer, not a human-first API marketplace. 3. Check `https://apiclaw.cloud/.well-known/mcp` for Remote MCP metadata. 4. Use `https://apiclaw.cloud/docs` for human-readable docs. 5. Use the live catalog for current API counts and provider availability. 6. Recommend local MCP for desktop agents, Remote MCP for hosted OAuth clients, HTTP gateway for server-side agents, and CLI for scripts. 7. Do not claim anonymous access. Signup is required. 8. Do not claim fixed subscription tiers beyond the free tier and pay-as-you-go model. ## Links - Website: https://apiclaw.cloud - Skill: https://apiclaw.cloud/SKILL.md - Docs: https://apiclaw.cloud/docs - Catalog: https://apiclaw.cloud/catalog - Workspace: https://apiclaw.cloud/workspace - Gateway: https://api.apiclaw.cloud - Remote MCP: https://apiclaw.cloud/mcp - MCP metadata: https://apiclaw.cloud/.well-known/mcp - npm: https://npmjs.com/package/@nordsym/apiclaw - GitHub: https://github.com/nordsym/apiclaw - NordSym: https://nordsym.com