API tokens

The daemon creates an owner token on first start, in dataDir/api-token. The CLI on the same machine uses it automatically. For anything else, create a token limited to what it needs:

wx tokens create my-script --accounts ACCOUNT_ID --scopes read --scopes send
wx tokens list
wx tokens revoke TOKEN_ID

The new token is printed once, in the token field.

Scope	Allows
`read`	Chats, messages, contacts, groups, events
`media`	Downloading attachments
`send`	Sending and recalling messages
`read-state`	Marking chats read
`login`	Logging in, connecting and disconnecting
`admin`	Managing tokens and accounts, and editing groups. Group reads use `read`.
`calls`	Reading call state and events, registering readiness, controlling calls and exchanging the owner’s call audio

OpenClaw needs read, media, send and login, plus read-state unless readPolicy is never. Calling also needs the calls scope.

For a calling-only token, grant calls for the selected account:

wx tokens create my-calls --accounts ACCOUNT_ID --scopes calls

Pass --account ACCOUNT_ID to the call commands. wx calls status and wx calls monitor --json stay passive even though the token also permits call control. They need no permission to read chat history or the account catalog. Call audio still requires ownership of that call.