Kernel Auth Skill Setup and manage Kernel managed authentication connections for any website with safety checks and reauthentication support. Quick Start kernel-auth setup gmail Then visit the URL printed to complete login. Works for any website — See Using Custom Domains for any other site. Usage kernel-auth setup < service

[ --profile-name < name

] Built-in Services gmail → gmail.com github → github.com outlook → outlook.com Using Custom Domains For any other website, use the --domain flag: kernel-auth setup --domain amazon.com --profile-name amazon-main kernel-auth setup --domain linkedin.com kernel-auth setup --domain example.com --profile-name custom-site Examples kernel-auth setup gmail kernel-auth setup github --profile-name github-work kernel-auth setup outlook Authentication Flow Create auth connection — Sets up a managed auth profile (domain + profile name) Initiate login session — Generates a hosted login URL You visit URL — Complete the login flow on your device/browser Login state stored in profile — Kernel saves your authenticated session Use authenticated browser — Create browser sessions with that profile, automatically logged in Key Concepts Auth Connections Each connection ties a service domain to a profile name Connections can be reused for multiple browser sessions Status: AUTHENTICATED (user completed login, state stored) or NEEDS_AUTH (never logged in or login session expired) Login Sessions Login sessions (the hosted URL) expire after a generous timeframe as cleanup If you don't complete login within that window, the session is deleted The connection itself stays — just initiate a new login session Check connection status: kernel auth connections list

Check status

kernel auth connections get < id

Get connection details

If a connection shows NEEDS_AUTH : kernel-auth setup < service

Re-initiate login session with fresh URL

Why Manual URL Visit? Login sessions are time-bound — If you don't visit within the window, they expire (cleanup) Prevent auto-opening — Avoid Telegram/email clients accidentally consuming the link Control is yours — You visit the URL when you're ready Checking Status

List all auth connections

kernel auth connections list -o json

Check specific connection

kernel auth connections get < connection-id

-o json | jq '.status' Using Authenticated Browsers Once auth is connected, create browser sessions with that profile:

Create browser with Gmail auth already loaded

kernel browser create --profile-name gmail-main --stealth -o json

Browser will be logged into Gmail automatically

Important Notes ⚠️ Profile Deletion = Cascade Delete Deleting a Kernel profile deletes ALL connections attached to it: kernel profile delete gmail-main

Deletes ALL gmail-main connections

Use sparingly. Better to refresh auth than delete and recreate. 🔗 Telegram & Link Previews If you send auth URLs via Telegram, disable link previews in settings: Settings → Privacy & Security → Link Preview → Never show Otherwise Telegram auto-opens the URL and consumes the code. 🌐 Network Requirements Kernel auth requires: Outbound HTTPS to Kernel's managed auth service Browser with JavaScript enabled Cookie/session storage support Scripts setup — Create connection, generate login URL, display instructions No background watchers — You control when/if you visit the URL Troubleshooting "Code already used" The auth code was consumed. This happens if: You visited the URL twice Telegram/email client auto-opened it Someone else completed the login first Solution: Run kernel-auth setup again to get a fresh code. "Code expired" Codes expire after ~40 minutes. Re-run setup to generate a new one. "Connection not found" The connection may have been deleted. Run setup again to create it. Auth Status is NEEDS_AUTH You didn't complete the login within the session window, or you need to re-authenticate. Re-initiate login: kernel-auth setup gmail Integration with OpenClaw The auth skill integrates with OpenClaw cron jobs: Cron job checks auth status before running If AUTHENTICATED , proceeds with browser automation If not, sends message requesting reauthentication User confirms, system re-runs auth flow Example from GMAIL_DAILY_WORKFLOW.md:

Daily cron checks this before scraping

AUTH_STATUS

$( kernel auth connections list -o json | jq -r ".[] | select(.domain == \" gmail.com \" ) | .status" ) if [ " $AUTH_STATUS " != "AUTHENTICATED" ] ; then echo "Reauthentication needed" exit 1 fi Advanced Programmatic Auth Check

Get auth status

kernel auth connections list -o json | jq '.[] | {id, status, domain}'

Delete and recreate

kernel profile delete gmail-main --yes kernel-auth setup gmail Multiple Accounts Create separate profiles for each account: kernel-auth setup gmail --profile-name gmail-personal kernel-auth setup gmail --profile-name gmail-work Then use the appropriate profile when creating browsers: kernel browser create --profile-name gmail-work --stealth