How to Configure OpenClaw Gateway Authentication

# In gateway.yaml:
auth:
  enabled: true
  type: api_key
  header_name: X-OpenClaw-API-Key
  key_storage: file  # Or: redis, postgres
  key_file: /app/data/api_keys.json

# Using OpenClaw CLI:
openclaw gateway keys create --name "user@example.com" --expires 90d

# Or manually:
openssl rand -hex 32
# Then add to api_keys.json:
{
  "keys": [
    {
      "key": "oclaw_abc123...",
      "name": "user@example.com",
      "created": "2025-01-16T10:00:00Z",
      "expires": "2025-04-16T10:00:00Z"
    }
  ]
}

# In gateway.yaml:
rate_limiting:
  enabled: true
  strategy: sliding_window
  limits:
    - scope: api_key
      requests: 100
      window: 60s
    - scope: api_key
      requests: 1000
      window: 3600s  # 1 hour
  response:
    status: 429
    message: "Rate limit exceeded. Try again later."

# In gateway.yaml:
ip_filtering:
  enabled: true
  mode: allowlist
  allowed_ips:
    - 192.168.1.0/24  # Internal network
    - 100.64.0.0/10   # Tailscale range
    - 203.0.113.5     # Specific external IP
  blocked_response:
    status: 403
    message: "Access denied: IP not allowed"

# Without API key (should fail):
curl http://localhost:3000/chat
# Response: 401 Unauthorized

# With valid API key (should succeed):
curl http://localhost:3000/chat \
  -H "X-OpenClaw-API-Key: oclaw_abc123..." \
  -d '{"message": "Hello"}'

# Check for expiring keys:
openclaw gateway keys list --expiring 30d

# Rotate a key:
openclaw gateway keys rotate --key oclaw_abc123... --notify user@example.com