Crabyard.ai

Admin

Admin controls govern access, repos, runtime caps, and merge policies.

Roles

Owner

Full administrative access.

Can:

Use cases:

Maintainer

Operational access without policy control.

Can:

Cannot:

Use cases:

Viewer

Read-only access.

Can:

Cannot:

Use cases:

Access Control

User Allowlist

Add individual GitHub users.

Format: @login

Example:

@steipete
@jane
@octocat

How to add:

  1. Admin panel → Users and teams
  2. Enter @login
  3. Select role (viewer, maintainer, owner)
  4. Click Add

Role inheritance:

Team Allowlist

Add GitHub teams (all members inherit access).

Format: @org/team

Example:

@openclaw/maintainer
@openclaw/core

How to add:

  1. Admin panel → Users and teams
  2. Enter @org/team
  3. Select role
  4. Click Add

Team membership:

Role Hierarchy

owner > maintainer > viewer

User’s effective role = strongest match across:

Examples:

User Allowlist Entries Effective Role
@alice @alice → maintainer maintainer
@bob @openclaw/core → owner owner
@charlie @charlie → viewer, @openclaw/maintainer → maintainer maintainer
@dave (none) (blocked)

Repo Allowlist

Only allowlisted repos can be used for cards.

Format: owner/repo

Examples:

openclaw/crabyard
openclaw/codex
steipete/PSPDFKit

How to add:

  1. Admin panel → Repos
  2. Enter owner/repo
  3. Click Add

Effects:

How to remove:

  1. Find repo in Repos list
  2. Click X button
  3. Existing cards preserved
  4. New cards blocked until re-added

Bulk management:

Org Policies

Concurrent Cap

Max number of simultaneous Running cards.

Default: 20 Range: 1-200

When cap reached:

Planning:

10 users × 2 cards = 20 cap
5 heavy jobs + 15 light = 20 cap

How to set:

  1. Admin panel → Policy
  2. Enter new cap (1-200)
  3. Click Save policy

Recommendations:

Log Retention

Product retention setting for run logs.

Options:

Effects:

How to set:

  1. Admin panel → Policy
  2. Select retention period
  3. Click Save policy

Notes:

Direct Merge Permission

Configured direct merge policy. The current Worker stores this policy; real merge execution is a planned integration.

Options:

Guarded (default):

Disabled:

Maintainers only:

How to set:

  1. Admin panel → Policy
  2. Select direct merge mode
  3. Click Save policy

Recommendations:

Repo Workflows

Owners can refresh CRABYARD.md for enabled repos from Admin → Workflows. For private repos, the Worker needs deployment GITHUB_TOKEN access to fetch the file; it does not use the logged-in user’s OAuth token for this refresh.

Supported shape:

---
runtime:
  default: auto
merge:
  default_policy: open_pr
---

What is stored:

Only runtime and merge defaults in ok configs influence card defaults and runtime selection today. stall_ms, cap, prompt_prefix, and the Markdown body are parsed/stored for future policy work. Invalid configs are visible in Admin and ignored.

Auth

GitHub OAuth

Recommended for production.

Setup:

  1. Create GitHub OAuth app in your org
  2. Callback URL: https://crabyard.openclaw.ai/auth/github/callback
  3. Scopes: read:user, read:org
  4. Add secrets to Cloudflare Worker:
    • GITHUB_CLIENT_ID
    • GITHUB_CLIENT_SECRET
    • GITHUB_TOKEN for all enabled repo previews and private repo CRABYARD.md refreshes (optional; public/default repo paths work without it)
  5. Set GITHUB_ORG var (default: openclaw)

Session lifetime:

Benefits:

Bootstrap Token

Admin break-glass access.

Setup:

  1. Generate strong random token: openssl rand -hex 32
  2. Set as CRABYARD_BOOTSTRAP_TOKEN secret in Cloudflare
  3. Share securely with initial admin

Session lifetime:

Security:

When to use:

Recommended workflow:

  1. Bootstrap admin logs in
  2. Adds own GitHub user to allowlist as owner
  3. Logs out bootstrap
  4. Logs in via GitHub OAuth
  5. Normal operations use GitHub OAuth only

Audit Log

All admin actions logged to D1.

Logged events:

Example entries:

2026-05-17 14:32:01 @steipete allowlist updated @jane role=maintainer
2026-05-17 14:35:12 @steipete repo allowlisted openclaw/crabyard
2026-05-17 14:40:00 @steipete policy updated cap=30 retention=30 merge=guarded
2026-05-17 15:10:45 @jane operator takeover granted for CY-101
2026-05-17 15:45:00 @jane merged PR openclaw/crabyard#456 commit=abc123

Retention:

Access:

Secrets Management

Secrets stored in Cloudflare Worker environment, never in D1/R2.

Secret Types

Bootstrap token:

GitHub OAuth:

GitHub App (future):

Crabbox credentials (future):

Secret Access

At runtime:

Scoped delivery:

Secret Rotation

How to rotate:

  1. Generate new secret value
  2. Update Cloudflare Worker secret via dashboard or wrangler secret put
  3. Old sessions fail after expiry (15min-1hr)
  4. All new sessions use new secret

When to rotate:

Best practices:

API

List Allowlist

GET /api/state

Returns full state (owner role only):

{
  "user": {...},
  "allow": [
    {"value": "@steipete", "role": "owner"},
    {"value": "@openclaw/maintainer", "role": "maintainer"}
  ],
  "repos": ["openclaw/crabyard", "openclaw/codex"],
  "cap": 20,
  "retention": "30",
  "merge": "guarded"
}

Add User/Team

POST /api/admin/allow
{
  "value": "@jane",
  "role": "maintainer"
}

Returns updated state.

Remove User/Team

DELETE /api/admin/allow/@jane

URL-encode value: DELETE /api/admin/allow/%40jane

Add Repo

POST /api/admin/repos
{
  "repo": "openclaw/crabyard"
}

Remove Repo

DELETE /api/admin/repos/openclaw%2Fcrabyard

URL-encode owner/repo → owner%2Frepo

Update Policy

PUT /api/admin/policy
{
  "cap": 30,
  "retention": "60",
  "merge": "disabled"
}

All fields optional. Omitted fields unchanged.

Monitoring

Metrics

Dashboard shows:

Healthy state:

Warning signs:

Audit Review

Owner should periodically review:

How to review:

SELECT * FROM audit_events
WHERE created_at > strftime('%s', 'now', '-7 days') * 1000
ORDER BY created_at DESC;

Query D1 directly via wrangler d1 execute.

Best Practices

Allowlist Management

Start small:

Use teams:

Review regularly:

Repo Management

Allowlist only active repos:

Avoid wildcards:

Policy Tuning

Concurrent cap:

Log retention:

Direct merge:

Security

Bootstrap token:

GitHub OAuth:

Secrets:

Audit log:

Troubleshooting

User can’t log in via GitHub

Cause: Not in OpenClaw org or not allowlisted

Solution:

  1. Verify user is in GitHub org
  2. Check allowlist for @login or @org/team entry
  3. Add if missing

Team allowlist not working

Cause: GitHub team membership not synced

Solution:

Repo not appearing in dropdown

Cause: Repo not allowlisted

Solution:

  1. Admin → Repos
  2. Add owner/repo
  3. Refresh page

Direct merge blocked

Cause: Policy disabled or guardrails failed

Solution:

  1. Check Admin → Policy → Direct merge setting
  2. Verify CI checks all green
  3. Verify branch up to date
  4. Check no active takeover
  5. User has maintainer+ role

Next Steps