How to securely give your OpenClaw bot access to a private GitHub repo

• Log in once and let gh store credentials for the user running OpenClaw.
• Then use gh for PR operations.

2) Git credential helper (HTTPS Git):

• Configure a credential helper so Git prompts once and stores the token securely.

Option B (tightest scope): SSH deploy key (single repo)

A deploy key is great when:

• you only need access to one repo
• you want a clean “bot key” you can rotate independently

Steps

1. Generate a dedicated keypair on the server:

• ssh-keygen -t ed25519 -C "openclaw" -f ~/.ssh/openclaw_github -N ""

2. Add the public key to the repo:

• Repo → Settings → Deploy keys → Add deploy key
• Check Allow write access only if the bot must push

3. Set the Git remote to SSH:

• git remote set-url origin git@github.com:OWNER/REPO.git

Pros/cons

• ✅ scoped to a single repo
• ✅ easy to revoke by removing the key
• ❌ doesn’t automatically grant API access (PR listing still needs gh auth)

Avoid the common security foot-guns

• Don’t paste tokens into chat logs or commit them to files.
• Don’t hardcode tokens into scripts.
• Don’t put tokens in Git remotes.
• Use separate bot credentials (don’t reuse your personal root token).
• Rotate tokens periodically.

If you’re building agentic workflows for your product and want a secure playbook, see Zeiko: https://zeiko.io.

Revocation playbook (when something feels off)

If you suspect the token/key leaked:

1. Revoke immediately

• PAT: GitHub → Tokens → revoke
• SSH deploy key: remove key from repo settings

2. Rotate

• create a new token/key with least privilege

3. Audit

• check recent pushes, PR activity, and CI logs

A practical “safe default” setup

If you want a simple, robust setup for an OpenClaw bot:

• Git operations: SSH deploy key (write) scoped to the single repo
• GitHub API: fine-grained PAT scoped to the same repo (PR read/write)
• Keep both under the same non-human “bot” identity where possible

That’s usually enough to:

• clone/push branches
• open PRs
• list PRs and fetch diffs

Want a hardened, repeatable workflow for your own agent setup? Start at https://zeiko.io.