Lesson 25 — OpenClaw API Gateway Skill: Zero-Config OAuth Integration with Slack, HubSpot, and 100+ Services (2026)

Goal: Install the API Gateway Skill to let OpenClaw connect to Google Workspace, Microsoft 365, GitHub, Notion, Slack, Airtable, HubSpot, and 100+ services — without setting up your own OAuth credentials.

The Core Value of API Gateway

The biggest selling point: no need to apply for OAuth credentials yourself.

Traditional approach: to have OpenClaw send a Slack message, you'd have to go to the Slack developer portal, register an App, apply for OAuth credentials, configure a callback URL, save the token... The whole process takes at least 30 minutes and is easy to get wrong.

API Gateway's approach: install Skill → click an authorization link → done. OAuth credentials are centrally managed on API Gateway's cloud. One click to authorize and you're ready to use.

100+ Supported Services

Run /api-gateway list after installation to see the full list of supported services.

Step 1: Install the Skill

/install @byungkyu/api-gateway

Verify:

pnpm openclaw skills list
# api-gateway should appear in the list

Step 2: Authorize Your First Service (Slack Example)

Complete steps to connect Slack with no extra configuration:

1. Trigger the authorization flow:

/api-gateway auth slack

2. OpenClaw returns an authorization link:

Please click the following link to authorize Slack:
https://gateway.clawhub.io/auth/slack?token=xxxx&callback=openclaw

3. Open the link in your browser, log in with your Slack account and click "Allow."

4. The page redirects back to OpenClaw and shows:

Slack authorization successful! Workspace: Your-Team-Name
Available permissions: send messages, read channel list, upload files

Authorization info is encrypted and stored on the API Gateway cloud. OpenClaw locally stores only a short-lived access token that auto-refreshes within its validity period — no need to re-authorize.

Step 3: Send Slack Messages

After authorization, use natural language directly:

Send a message to the #general Slack channel:
"All-hands meeting this Friday at 3 PM — please confirm attendance."

Or use a structured command:

/api-gateway slack send-message --channel general --text "All-hands meeting Friday, please confirm attendance"

Send a direct message:

DM @alice on Slack: I've looked at tomorrow's design mockup — there are a few things to adjust. Can we sync this afternoon?

Step 4: Read Airtable Data

Authorize first:

/api-gateway auth airtable

Then query:

Read all records with status "Pending Follow-up" from the "Client Tracking" table in Airtable,
listing client name, contact person, and last follow-up date

Add a new record:

Add a new record to the "Client Tracking" table in Airtable:
Client: Acme Corp, Contact: Sarah Johnson, Status: Initial Contact, Follow-up Date: 2026-03-30

Step 5: HubSpot CRM Operations

Common use cases:

Search for a contact:

/api-gateway hubspot search-contact --email zhang@example.com

Create a follow-up task:

Create a follow-up task in HubSpot for contact zhang@example.com:
Task: Send Q1 product proposal, due date: 2026-04-05

Bulk update lead status (combined with AI analysis):

Read all leads added this month in HubSpot, categorize by company size,
and change the status of leads with over 500 employees to "High Priority"

Step 6: API Gateway vs. Directly Configuring MCP

API Gateway's "no need to set up OAuth yourself" is its core advantage, but both approaches have their place:

FAQ

What's the difference between API Gateway Skill and directly configuring MCP?

API Gateway Skill delegates OAuth credential management to ClawHub's cloud gateway — you don't need to register apps or save tokens yourself, making it ideal for quickly connecting mainstream SaaS services. Direct MCP configuration requires you to create developer apps on each platform, apply for credentials, and manually fill in OpenClaw's config file — more work but fully self-managed, suitable for internal services or scenarios with strict data sovereignty requirements. The two are functionally equivalent; the difference is who manages the credentials.

Do I need an enterprise account to connect Slack via API Gateway?

No — free personal or small-team Slack accounts are supported just as well. API Gateway uses Slack's official OAuth authorization flow, independent of account type. The only limitation is Slack's free plan's 90-day message history limit, which is a Slack restriction unrelated to API Gateway. Paid enterprise accounts don't have this limitation.

Where is authorization info stored? Is it secure?

OAuth access tokens are encrypted and stored on ClawHub's API Gateway servers using AES-256 encryption. OpenClaw locally caches only a short-lived token (default 1 hour). ClawHub does not read or log business data content passing through the API Gateway — it only handles credential refresh and forwarding. If you revoke authorization in your ClawHub account settings, the corresponding service token is immediately invalidated.

If a service API has rate limits, does API Gateway handle that?

Yes. API Gateway has built-in Rate Limit Guard — when it detects you're approaching a service provider's frequency limit, it automatically queues and throttles, and notifies you of current quota usage in the OpenClaw conversation. For example, HubSpot's free plan allows 250 API calls per day — API Gateway will warn you when 50 calls remain, preventing service interruption from exceeding the limit.

Next Steps

• Lesson 26 — Use Agent Browser to handle web pages that require login state or JavaScript rendering
• Lesson 24 — Package your automation workflow as a Skill and publish it to ClawHub