OpenClaw (coding agent)

Like Hermes, OpenClaw lets the Co-founder delegate well-scoped build tasks to a coding agent you host. When a competitor ships a feature you lack, Appeeky packages the strategic brief and triggers an isolated agent run on your OpenClaw gateway via its webhook ingress. OpenClaw owns the sandbox, repo access, and delivery. Appeeky never runs code. This is the engineering_delegate action with provider: "openclaw".

How it works

Co-founder run
  → feature gap + evidence detected
  → reasoner emits `engineering_delegate` (provider: openclaw)
  → you approve it (delegations always require explicit approval)
  → Appeeky POSTs to your gateway: POST /hooks/agent
  → OpenClaw runs an isolated agent turn (own session, sandbox, model)
  → OpenClaw delivers the result to your channel (optional)

Appeeky stores the returned runId as the action’s external_id.

Prerequisites

Enable the hooks ingress on your OpenClaw gateway and expose it to Appeeky (public URL or tunnel):

// ~/.openclaw/config (or your gateway config)
hooks: {
  enabled: true,
  token: "<a-strong-secret>",          // Appeeky "Hook token"
  path: "/hooks",
  allowRequestSessionKey: true,        // required — Appeeky sends hook:appeeky:… keys
  allowedSessionKeyPrefixes: ["hook:"],
  allowedAgentIds: ["engineering", "main"],
}

See the OpenClaw webhook docs. Before saving, Appeeky calls GET /healthz (JSON probe) and verifies your hook token via POST /hooks/agent (empty body → 400 when auth passes).

Reachability & security (you host the gateway)

Appeeky is the strategist; you host the coding agent. Appeeky’s servers call the baseUrl you provide, so the gateway must be publicly reachable and locked down:

Public HTTPS required in production. In production, baseUrl must be an https:// URL — plain http:// is rejected.
Private addresses are blocked. For SSRF safety, Appeeky refuses gateway URLs that resolve to loopback (127.0.0.1, localhost), private ranges (10.x, 172.16–31.x, 192.168.x), link-local / cloud-metadata (169.254.169.254), or other reserved addresses.
Two ways to expose it:
- Cloud VM + durable hostname (recommended): named Cloudflare Tunnel or TLS reverse proxy — see Hosting a coding agent.
- Tunnel (quick start only): cloudflared tunnel --url http://localhost:18789 — hostname changes on restart; not for production.
Keep hooks.token strong & rotate it. Restrict targets with allowedAgentIds. Appeeky stores the token encrypted and never returns it to the client.

Local development only: in dev (NODE_ENV != production) a http://127.0.0.1:18789 gateway is allowed for testing. This never applies to the hosted product.

Setup

curl -X PUT https://api.appeeky.com/v1/cofounder/integrations/openclaw \
  -H "X-API-Key: $APPEEKY_KEY" \
  -d '{
    "credentials": { "token": "<hooks.token>" },
    "integrationConfig": {
      "baseUrl": "https://your-host:18789",
      "agentId": "engineering",
      "deliver": "slack",
      "to": "#dev"
    }
  }'

Before saving, Appeeky calls GET /healthz on your gateway (JSON ok: true) and verifies the hook token (auth probe on /hooks/agent).

Field	Where	Required	Notes
`token`	credentials	✅	Your gateway’s `hooks.token`
`baseUrl`	config	✅	Full URL incl. port, e.g. `https://host:18789`
`hooksPath`	config	—	Custom `hooks.path` if not `/hooks`
`agentId`	config	—	Route to a specific agent (must be in `allowedAgentIds`)
`deliver`	config	—	Delivery channel (e.g. `slack`, `telegram`)
`to`	config	—	Delivery target (e.g. `#dev`, a chat id)

Enable

PUT /v1/cofounder/preferences
{ "enabledIntegrations": ["openclaw"] }

What Appeeky sends

POST https://your-host:18789/hooks/agent
Authorization: Bearer <hooks.token>

{
  "message": "# Engineering task from App Co-founder …",
  "sessionKey": "hook:appeeky:<appId>:<task-slug>",
  "name": "Appeeky Co-founder",
  "agentId": "engineering",
  "deliver": true,
  "channel": "slack",
  "to": "#dev",
  "wakeMode": "now"
}

The brief always ends with draft-PR-by-default guardrails.

Safety model

No Appeeky secrets leave Appeeky. Your repo access lives on the OpenClaw side.
Always approval-gated. Delegations never auto-run by autopilot level — each waits for your explicit approval.
Read mode blocks it. In agentMode: read, no delegations are proposed.
Scoped routing. Use allowedAgentIds on your gateway to restrict which agents Appeeky may target.

Disable

DELETE /v1/cofounder/integrations/openclaw

Get Started

Concepts

Knowledge Base

Capabilities

Integrations

API Reference

How it works

Prerequisites

Reachability & security (you host the gateway)

Setup

Enable

What Appeeky sends

Safety model

Disable

​How it works

​Prerequisites

​Reachability & security (you host the gateway)

​Setup

​Enable

​What Appeeky sends

​Safety model

​Disable

How it works

Prerequisites

Reachability & security (you host the gateway)

Setup

Enable

What Appeeky sends

Safety model

Disable