Maton API Gateway Skill: a safe OpenClaw starter for app APIs

API Gateway is Maton’s OpenClaw Skill for calling third-party app APIs through Maton. It can route requests to an app account you have already connected; installing the Skill does not itself grant access to Slack, Gmail, or any other account. It is not a general-purpose browser.^[1]

This guide uses one bounded first task—list up to ten public Slack channels—to help you verify three separate layers: the Skill is installed, the Maton CLI is authenticated, and you personally authorized a Slack connection. The prompt is an example exercise, not a QClawHub test result.

Install the Skill and CLI separately

In a terminal where OpenClaw is installed, add the Skill to the active workspace:

openclaw skills install @byungkyu/api-gateway

Check its provenance and trust result before using it:

openclaw skills verify @byungkyu/api-gateway

OpenClaw advises treating community Skills as untrusted code and reading them before enabling them. If verification fails, do not bypass it with a force option.^{[3] [4]}

Install the separate Maton CLI. The ClawHub release file for version 1.2.32 pins it to 0.5.0:

npm install -g @maton/cli@0.5.0

This installs the underlying maton program, not the Skill. If global npm installs are not allowed on your machine, check Maton’s current alternatives; do not mix an unpinned CLI install with login flags copied from an older release.^[1]

Maton login is not a Slack connection

Run maton login in your terminal. With the CLI version bundled by ClawHub 1.2.32, the flow is to open the link printed by the command, sign in in your browser, and pass the displayed verification code to the local command:

maton login
maton login --code <code-shown-in-browser>
maton whoami --json

The last command should report authenticated: true. Do not paste the code, token, login link, or full terminal JSON into a chat transcript. Maton’s current online CLI page describes a different login flow from the versioned ClawHub Skill; follow the help and release file for the version you installed, then re-check before upgrading.^{[1] [5]}

Maton CLI login establishes your identity with Maton. Calling an app needs a separate app connection: in Maton’s Connections console, choose Slack, review the requested permissions, and complete OAuth yourself. Continue only when the connection is ACTIVE. If there is no active connection, stop; do not let the agent create one on its own.^{[6] [7]}

First task: read no more than 10 public channels

Check existing Slack connections locally:

maton connection list slack --status ACTIVE

If more than one Slack workspace is connected, identify and choose one locally. Connection output may contain account metadata or a temporary authorization URL; do not paste the whole response into the agent. Provide only the connection ID you selected. Without an explicit connection, the gateway may select the oldest active connection, which can mean the wrong workspace.^{[1] [8]}

In an OpenClaw conversation, try this bounded exercise:

Use api-gateway. First check only my Maton login state and existing ACTIVE Slack connections; do not create, delete, or change a connection.
If there is no ACTIVE Slack connection, stop and tell me I must authorize it myself. If there is more than one, ask me to choose; do not expose email addresses, authorization URLs, or tokens.
After I choose, read only the names and IDs of at most 10 public Slack channels through that connection.
Do not post messages, modify data, create functions or triggers, or print secrets, tokens, private channels, or message bodies. Stop and ask me before any write or permission expansion.

Acceptance checks: Maton authentication succeeds; the selected Slack connection is explicitly ACTIVE; the request targets that connection by ID; the result contains at most ten public channel names and IDs; and no write was made. Check Slack’s business fields too (such as ok): an HTTP success alone does not guarantee that the upstream API operation succeeded.^{[1] [8]}

To run the same read manually, first get the real connection ID from your local CLI, then use:

maton slack channel list --types public_channel --limit 10 --connection <your-selected-ACTIVE-connection-ID>

Replace the placeholder in angle brackets. Do not publish a real connection ID, account metadata, or output screenshot.

Common blockers

These status codes can originate at Maton or be relayed from the third-party API. If the response includes Proxy-Status, use it to identify which layer returned the error.^{[7] [8] [10]}

Do not deploy automation for the first task

The Skill also documents hosted functions, triggers, webhook destinations, event replay, and local event handlers. These create persistent resources, run code, or forward events; their impact is much greater than one API read. A routine read or query does not require a function. Start with the read-only call. Discuss automation only after you can name its goal, data handling, connection identity, network scope, and cleanup plan. Follow the current Skill’s requirement for separate explicit approval before writes, creating connections/functions/triggers, replaying events, or running a local handler.^[1]

Pricing and version limits

As of 2026-10-31, Maton’s pricing page lists Hobby as free, with up to 30 active connections and 10 requests per second. Some premium apps may require a paid plan, and each third-party service has its own pricing, permissions, and API limits. Installing the Skill does not make every connection free; re-check current pricing and the app catalog before authorizing a service.^{[7] [9]}

The ClawHub versions API returned 1.2.32 as the latest release on the review date, and that release’s Skill file pins @maton/cli@0.5.0; the rendered ClawHub page still showed an older 0.4.0 install snippet. Prefer the explicit pin in the version file, then compare the version history and commands before upgrading. QClawHub did not connect to Maton or Slack and did not run the install or API call; verify the sample output inside your own authorized environment.^{[1] [2]}