Authentication Modes
- Session cookie (
cm_session) for browser-first UX flows. - Magic-link bearer tokens (
mpk_...) for external app onboarding. - API keys (
cmk_...) for agent delivery and install reporting.
Required API Key Scopes
deliveries:readfor/v1/agent/entitlementsand/v1/agent/deliveries/requestdeliveries:writefor/v1/agent/install-reportsubmissions:writefor/v1/agent/submissionswhen enabled
SDK-First Install Flow
pnpm --filter @clawmagic/agent-sdk install:plugin -- \ --entitlement ent_123 \ --target ./clawmagic/plugins
Or run the CLI bin directly: clawmagic-install --entitlement ent_123 --target ./clawmagic/plugins
Raw API Golden Path (No SDK)
- Call `POST /v1/agent/deliveries/request`.
- Download `signedDownloadUrl` immediately.
- Verify SHA256 checksum before install.
- Unzip with path traversal protection and validate `claw.plugin.json`.
- Call `POST /v1/agent/install-report` with SUCCESS or FAILED.
Agent UX Requirement
Delivery/install/submission responses include agentMessage. Surface this text in agent UI so users understand collaboration value and next actions.
Deep references: API quickstart, golden path, endpoint table, and apps/api/openapi/public.yaml.