Klaus Ai Authentication

generated: '2026-07-19'
method: derived
source: npm @klausai/cli@0.1.7 (dist/klaus.js published bundle); https://klausai.com/terms/; https://klausai.com/privacy/
docs: https://klausai.com/account
note: >-
  Klaus publishes no OpenAPI description, so 0-working/derive-authentication.py had nothing to read. This
  profile was derived from the provider's own published npm client (@klausai/cli), which is the authoritative
  first-party implementation of the auth handshake, plus the Terms and Privacy pages for end-user account auth.
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - deviceCode
  end_user_identity: Google OAuth (account registration, per Terms of Service section 3)
schemes:
- name: apiKeyAuth
  type: apiKey
  in: header
  parameter_name: x-api-key
  description: >-
    Personal API key created at https://klausai.com/account. The CLI reads it from the KLAUS_API_KEY
    environment variable first, then from its on-disk config file.
  env_var: KLAUS_API_KEY
  create_at: https://klausai.com/account
  sources:
  - npm:@klausai/cli@0.1.7
- name: bearerAuth
  type: http
  scheme: bearer
  description: >-
    Session access token issued by the device authorization grant, sent as Authorization: Bearer <token>.
  sources:
  - npm:@klausai/cli@0.1.7
- name: deviceGrant
  type: oauth2
  flows:
  - flow: deviceCode
    standard: RFC 8628 OAuth 2.0 Device Authorization Grant
    device_authorization_url: https://api.klausai.com/api/auth/device/code
    token_url: https://api.klausai.com/api/auth/device/token
    grant_type: 'urn:ietf:params:oauth:grant-type:device_code'
    client_id: klaus-cli
    scopes: []
    scopes_note: The device grant as implemented by the CLI requests no scopes; Klaus documents no scope registry.
  sources:
  - npm:@klausai/cli@0.1.7
request_scoping:
- header: x-klaus-instance-id
  description: Selects which hosted OpenClaw instance a request targets when an account has more than one.
webhook_authentication:
  description: >-
    Instance webhooks are created from the Klaus Integrations page and issue a URL plus a token; external
    services send authenticated HTTP requests to that URL to trigger the agent.
  source: https://klausai.com/faq/
integration_authentication:
  description: >-
    Downstream provider credentials (Google Workspace OAuth, Slack, GitHub, AgentMail, OpenRouter BYOK,
    ChatGPT subscription linking) are connected per-instance from the Integrations and Billing pages, with
    user-selectable Google permission scopes (none, read-only, or full access).
  source: https://klausai.com/privacy/
scopes_artifact: null
scopes_note: >-
  No OAuth scope registry is published for the Klaus platform API itself, so scopes/ is intentionally absent.
  The only user-facing scope selection is over Google Workspace, which is Google's scope surface, not Klaus's.