Skip to content
1Claw Academy
← Curriculum
Beginner

Foundations

Get the core ideas, install the CLI, and store your first secret.

By the end of this track

You’ll be able to create a vault, store and read a secret, and connect an AI client to it over MCP.

13 lessons~32 min39 questions
Start → What is 1Claw
  1. 1What is 1Claw1Claw is an HSM-backed, zero-trust vault that lets humans store secrets and lets AI agents fetch only what they're allowed to at runtime.
  2. 2Vaults, Secrets, and Envelope EncryptionSecrets live at slash-separated paths inside vaults, get a new version on every write, and are protected by a per-secret data key wrapped by the vault's HSM key.
  3. 3Humans vs Agents1Claw has two principal types: humans who own secrets with 1ck_ keys, and agents who trade an ocv_ key for a short-lived JWT and see only what a policy allows.
  4. 4Install the CLIInstall @1claw/cli, log in with the browser device flow, and confirm access with whoami and vault list.
  5. 5Lab: find out who else can read your configLabCheck the permissions on a file you just created, and on the directory it sits in.
  6. 6Start local: a vault with no accountEncrypt secrets on your own machine with 1claw local, before you sign up for anything.
  7. 7Lab: check that the vault file is opaqueLabTake the claim that the local vault is encrypted at rest and verify it yourself with strings, xxd and a wrong passphrase.
  8. 8Bring your existing .envImport the .env files you already have, then export them back on demand so your tooling never changes.
  9. 9Lab: watch a secret cross into a process you did not writeLabPut a credential in the environment, spawn something, and see what it inherits.
  10. 10Lab: delete a secret and watch it surviveLabCommit a .env, remove it, add a .gitignore, then read the secret straight back out of the repository.
  11. 11Your First Vault and SecretUse the CLI to create a vault, store a secret, and read it back, with the dashboard as an alternative.
  12. 12From local to cloudPush your local vault to a hosted one when you need a second person, a second machine, or an agent.
  13. 13Lab: verify the docs against the live APILabFetch 1Claw's real, live OpenAPI spec and confirm the endpoints this course has been telling you about actually exist, with the same method used to build the course.