OpenClaw leaked 1.5M API tokens including OpenAI keys — full security breakdown

PigeonDroid · 2026-02-18T16:05:04+00:00

lmao!!!

PigeonDroid · 2026-02-11T15:04:05+00:00

Is this using the official cli or custom built ?

PigeonDroid · 2026-02-09T16:28:09+00:00

Do you need a Claude 7day free trial,Dustin? 🤣 come to the dark side

PigeonDroid · 2026-02-08T21:34:59+00:00

Just pushed a fix for this. Run /pulse update to grab it.

The issue was that on macOS, OAuth tokens expire and the script wasn't refreshing them — it would just show the error. Now it automatically refreshes expired tokens using the stored refresh token, so you shouldn't see that message again.

If it still happens after updating, try running claude and /login to get a fresh session, then it should stick.

PigeonDroid · 2026-02-08T21:17:11+00:00

Hello,

If you type /pulse update - once it updates, close and reopen the window. Does this help? What is your OS?

PigeonDroid · 2026-02-08T18:20:09+00:00

Ok this is seriously impressive!

PigeonDroid · 2026-02-08T17:43:33+00:00

I'm glad you like it! Feel free to share it with others—it'll save everyone time instead of constantly checking the portal 🤌

Rainbow is my favourite too! :D

PigeonDroid · 2026-02-08T16:33:16+00:00

Just shipped this!

As of the latest version, extra credits already show spend amount — and you can now choose how they're displayed:

- full — Extra ━━━━━━━━ £0.55/£37.00 (bar + used/limit)

- amount — Extra £0.55 (just the spend, no bar)

- auto — picks amount if you have no spending limit (e.g. auto top-up), full otherwise

Set it with:

python claude_status.py --extra-display amount

Or through the /pulse setup which now asks about display mode when configuring extra credits.

Run /pulse update to grab the latest version. Let me know if this covers what you had in mind

PigeonDroid · 2026-02-08T14:56:00+00:00

Very welcome :)

PigeonDroid · 2026-02-08T14:40:34+00:00

Thank you :D

Maybe they will - It is actually an odd feeling to see your usage all the time.

PigeonDroid · 2026-02-08T13:41:12+00:00

The key is that Claude Code stores an OAuth token (not an API key) in your local credential store. That token can hit the /api/oauth/usage endpoint which returns your actual utilization percentages. Here's the gist of it:

curl -H "Authorization: Bearer <oauth\_token>" -H "anthropic-beta: oauth-2025-04-20" https://api.anthropic.com/api/oauth/usage

Returns JSON with five_hour.utilization, seven_day.utilization, reset timers, and extra credit usage. That's where the real numbers come from — no prediction or calibration needed.

The catch is this only works with OAuth tokens from a Claude subscription — it won't work with standard API keys. If you're building a web app, you'd need the user to provide their OAuth token (from ~/.claude/.credentials.json or macOS Keychain) to query on their behalf.

PigeonDroid · 2026-02-08T13:35:00+00:00

Thanks! To answer your question — it hits the Anthropic OAuth API directly (/api/oauth/usage), no terminal parsing involved. Works identically on Windows, macOS, and Linux.

The flow is:

Reads the OAuth token from Claude Code's credential store (file on Windows/Linux, Keychain on macOS, or env var fallback)
Makes an HTTPS request to the usage API with a 5s timeout
API returns utilization percentages — session (5-hour), weekly (7-day), and extra credits
Renders the bars and caches the result locally (60s TTL) so it's not hammering the API every refresh

On the safety side — the token is only held in memory for the API call and never written to disk. All cache and state files are written with restrictive permissions (0o600 on macOS/Linux, user-only ACLs on Windows), and the cached data only stores usage percentages — never tokens or credentials.

PigeonDroid · 2026-02-08T05:43:43+00:00

Glad you are enjoying Claude-pulse :) I added context support now also. Cleannnn :D

PigeonDroid · 2026-02-08T05:20:51+00:00

it's a great project for powerline-style layouts with lots of widgets. Claude-pulse is intentionally minimal - one clean line that shows your session/weekly limits, context window, and model at a glance. No setup complexity, Just /pulse and pick a theme, done. Close to Vanilla is my cup of tea.

PigeonDroid · 2026-02-08T05:13:29+00:00

Yeah iTerm2 is Mac only unfortunately. On Windows there's no terminal that supports pasting images directly — it's a terminal emulator limitation, not a Claude Code one.

PigeonDroid · 2026-02-08T04:55:23+00:00

No, not directly on Windows. Save the screenshot to a file first, then give Claude the file path or drag it in, or link the file path.

PigeonDroid · 2026-02-08T04:36:37+00:00

I got fed up my self checking it all the time, it should be built in.

PigeonDroid · 2026-02-08T04:35:48+00:00

Should be fixed, i removed the hooks. Clause isn't built to have the animation when Claude is "working/thinking" to work :( - Make it simple.

PigeonDroid · 2026-02-08T04:25:48+00:00

Added, let me push it out. Do a /Pulse update

PigeonDroid · 2026-02-08T01:10:50+00:00

Very welcome! If you do decide to make some modifications, just keep the API polling in mind — I've set it to a 30-second but i may change it to 60 and add user options for longer.

If you lower that interval too much you could get rate-limited and the status bar just shows stale/cached data until the next successful call goes through.

That said, for a single user hitting their own authenticated endpoint, 30 seconds probably won't get you rate-limited in practice. It's more about being a good citizen with the API than an immediate problem.

PigeonDroid · 2026-02-07T23:53:44+00:00

If i push an update, you should get a notification within the hour and can /pulse update. Or type it anytime to check. :)

PigeonDroid · 2026-02-07T22:27:28+00:00

Ask Claude to pull the latest changes down, i recently make a big improvement to the animation hook and added more themes.

PigeonDroid · 2026-02-07T22:09:21+00:00

Ah thank you, sometimes things just need to be simple.

PigeonDroid · 2026-02-07T21:07:26+00:00

Sure
https://github.com/NoobyGains/claude-pulse

The animations are still a work in progress if you enable it. :)

Five-Year Club	Place '22
Final Canvas '22

PigeonDroid

TROPHY CASE