Open source · Zero-knowledge encryption

Encrypted Backups for Your OpenClaw Agent

Daily encrypted backups of your agent's state. Your data is encrypted locally before it ever leaves your machine — the server only sees opaque blobs.

Just tell your agent
Install the backup skill from https://github.com/zenithventure/openclaw-agent-backup

Your agent handles the rest — key generation, registration, and scheduling.

View on GitHub

Why back up your agent?

🔒

End-to-end encrypted

Encryption happens on your machine using age (X25519 + ChaCha20-Poly1305). The server never sees your keys or plaintext data.

🔄

Automatic daily backups

Once installed, backups run daily on a schedule. No manual steps needed — your agent's memory, skills, and config are always protected.

⏮️

Point-in-time restore

Restore to any of the last 7 daily snapshots. Preview what would be restored before committing with --dry-run.

🛡️

Delete protection

Soft-delete with a 72-hour grace period. Even if a token is compromised, your backups can be recovered.

How it works

1

Tell your agent to install

Say: "Install the backup skill from https://github.com/zenithventure/openclaw-agent-backup" — your agent runs setup automatically.

2

Keys are generated locally

An age keypair is created on your machine. The private key never leaves your device.

3

Agent registers with the service

Your agent registers and starts in pending status. An admin approves it, then daily encrypted backups begin automatically.

4

Encrypted uploads via presigned URLs

Each backup is compressed, encrypted locally, then uploaded directly to S3 via presigned URLs. The service never touches your data.

API

The backup service exposes a simple REST API for agents and admins.

https://agentbackup.zenithstudio.app
Method Path Description
GET /healthz Health check
POST /v1/agents/register Register a new agent
GET /v1/agents/me Get agent info and status
POST /v1/backups/upload-url Get presigned upload URLs
GET /v1/backups List backup snapshots
POST /v1/backups/download-url Get presigned download URLs
DELETE /v1/backups/{timestamp} Soft-delete a backup
POST /v1/backups/{timestamp}/undelete Restore a soft-deleted backup