Get your dream built 10x faster

How to integrate Openhue with OpenClaw

We build custom applications 5x faster and cheaper 🚀

Book a Free Consultation
4.9
Clutch rating 🌟
600+
Happy partners
17+
Countries served
190+
Team members
Matt Graham, CEO of Rapid Developers

Book a call with an Expert

Stuck on an error? Book a 30-minute call with an engineer and get a direct fix + next steps. No pressure, no commitment.

How to integrate Openhue with OpenClaw

 

Direct answer

 

Short answer: Install the OpenHue skill into ClawHub, configure authentication (either Philips Hue Cloud OAuth2 or local Bridge username), store credentials as secure environment variables or ClawHub secrets, and implement token refresh and webhook validation outside the agent if you need persistence or scheduled jobs. The skill itself should perform only stateless API calls to the Hue REST endpoint (local bridge API or Hue Cloud API) and be invoked by OpenClaw runtime triggers; if you need long-lived refresh logic, queues or event receivers, run that as an external service and call the skill via its configured invocation endpoint. Use standard OAuth best practices (state, scopes, HTTPS), validate webhooks, and debug by checking HTTP responses, logs, and token scopes.

 

Prerequisites

 

  • Philips Hue access: either a Hue developer account and Hue Cloud OAuth2 client (for remote/cloud control) or local Bridge access (bridge IP and a Bridge username created on the local network).
  • Access to ClawHub so you can install/configure the OpenHue skill and set secure environment variables or secrets.
  • A place to run any stateful components that must persist tokens, run scheduled syncs, or receive webhooks (a small web service, serverless function, or managed job runner). OpenClaw agent runtimes are best for stateless execution; do not rely on them for durable token storage unless ClawHub explicitly offers that feature as a secrets store.

 

Architecture and responsibilities (what runs where)

 

  • OpenHue skill (runs inside OpenClaw/OpenClaw agent): stateless code that receives inputs from the agent, reads credentials from environment variables or the ClawHub secrets store, and makes REST calls to the Hue API to read or change light state. Keep this code small and idempotent.
  • External services (run outside the agent): any persistent token storage, OAuth refresh workers, scheduled polling, or inbound webhook receiver endpoints. These components store long-lived refresh tokens, renew access tokens when needed, and call the OpenHue skill or directly call the Hue API as appropriate.
  • Authentication/Secrets: store client_id, client_secret, bridge username, and refresh tokens in a secure store (ClawHub secrets or an external secret manager). Provide them to the skill as environment variables at runtime.

 

High-level integration steps

 

  • Decide whether to use Hue Cloud OAuth2 (recommended for remote/cloud operation) or the Bridge local API (recommended for local-network setups). Each needs different credentials and discovery.
  • In your Hue developer console (if using Cloud OAuth2), register a client app and set a redirect URI that you control (this will be used in the OAuth authorization flow). Note the client_id and client_secret.
  • Install the OpenHue skill in ClawHub. In the skill configuration, expose the required env vars or references to ClawHub secrets for client_id, client_secret, redirect_uri, and (for local) bridge_ip and bridge\_username.
  • Implement the OAuth flow (outside or inside the skill): have a short-lived web endpoint to receive the authorization code, exchange it for access and refresh tokens, and store the resulting tokens in the secrets store. Keep refresh logic outside the agent if you need durability across restarts.
  • Make API calls from the skill to Hue using the stored access token (Authorization: Bearer ) or, for local Bridge API, use the Bridge username and the local HTTP API URL.
  • When tokens expire, run a refresh token flow (server-side job) to get a new access token and update the secrets. Ensure the skill reads the latest token when invoked.
  • Validate incoming webhooks (if using Hue events) using the verification method the Hue API provides (e.g., validating signatures or shared secrets), and route validated events to your external service which then triggers skill invocations or direct API calls.

 

Concrete OAuth and API examples (generic, real)

 

OAuth2 authorize URL (Hue Cloud):

  • Users visit: https://api.meethue.com/oauth2/authorize?response_type=code&client_id=YOUR_CLIENT_ID&state=RANDOM&redirect_uri=YOUR_REDIRECT_URI&scope=remote_control
  • Hue will redirect back to YOUR_REDIRECT_URI with ?code=AUTH\_CODE&state=RANDOM

Exchange the authorization code for tokens (curl):

# <b>//</b> Exchange authorization code for access + refresh token
curl -X POST "https://api.meethue.com/oauth2/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "YOUR_CLIENT_ID:YOUR_CLIENT_SECRET" \
  -d "grant_type=authorization_code&code=AUTH_CODE&redirect_uri=YOUR_REDIRECT_URI"

Refresh access token (curl):

# <b>//</b> Use stored refresh_token to get a new access_token
curl -X POST "https://api.meethue.com/oauth2/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "YOUR_CLIENT_ID:YOUR_CLIENT_SECRET" \
  -d "grant_type=refresh_token&refresh_token=STORED_REFRESH_TOKEN"

Local Bridge API example (concrete and widely-used):

  • To change a light on a local Hue Bridge (API v1), issue a PUT to: http://BRIDGE_IP/api/USERNAME/lights/LIGHT_ID/state
# <b>//</b> Turn on light id 1 using the local bridge username
curl -X PUT "http://192.168.1.10/api/your-bridge-username/lights/1/state" \
  -H "Content-Type: application/json" \
  -d '{"on":true}'

Cloud API call pattern (generic):

  • When using the Hue Cloud, send Authorization: Bearer <access\_token> and call the relevant resource path. The exact resource paths follow Hue Cloud API docs; you will call them with standard GET/PUT/POST and JSON bodies.
# <b>//</b> Example pattern to call Hue Cloud API (replace with actual documented resource path)
curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -H "Content-Type: application/json" \
     "https://api.meethue.com/route/to/resource" \
     -d '{"some":"payload"}'

 

How to wire this into ClawHub/OpenClaw correctly (practical)

 

  • Skill configuration: In ClawHub when you install the OpenHue skill, set configuration entries for CLIENT_ID, CLIENT_SECRET, REDIRECT_URI (for cloud) and/or BRIDGE_IP and BRIDGE\_USERNAME (for local). Prefer referencing secrets rather than embedding values.
  • Secrets and environment vars: Put access_token/refresh_token in a secrets store (ClawHub secrets or Vault). The skill should read the access token at invocation and fail cleanly if missing. The refresh process should run externally and update the secret.
  • Token refresh strategy: Implement a small external worker or serverless function that watches refresh\_token expiry and performs the refresh flow, updating secrets. Do not rely on an agent runtime that may be ephemeral for long-term token storage.
  • Invocation model: Keep skills stateless: on each invocation, the skill reads the current access token from the secrets store and makes immediate API calls to Hue. For scheduled routines, either use ClawHub’s scheduler (if available and stateless) or trigger the skill from your external scheduler.
  • Webhooks and events: If Hue can push events to you, terminate those pushes in an external HTTPS endpoint (it must be stable, reachable, and validate payloads). After validation, that endpoint can call the OpenHue skill or directly call Hue APIs as needed. Do not expose ephemeral agent endpoints directly to the public internet unless you have a stable public endpoint and webhook validation.

 

Security and operational best practices

 

  • Use HTTPS for every external redirect or webhook endpoint. Always use the OAuth state parameter to prevent CSRF in the authorize flow.
  • Store client\_secret and refresh tokens in a secure secret store. Limit access by role.
  • Limit OAuth scopes to the minimum needed (e.g., remote\_control).
  • Rotate credentials regularly and have a revocation/reprovision plan (re-register if client\_secret exposed).
  • Log HTTP responses and errors from Hue API calls (do not log secrets). Preserve timestamps and request IDs to trace issues.

 

Debugging checklist (when something breaks)

 

  • Confirm the token is valid: call a simple protected Hue endpoint with the token using curl and inspect the HTTP status and body.
  • Check that the client_id/client_secret pair is correct and that the redirect URI exactly matches the one registered.
  • Verify scopes: ensure you requested the scope required for the operation (e.g., remote\_control).
  • Inspect logs from the OpenHue skill invocation for HTTP status codes, JSON error bodies, and exception traces.
  • If using local Bridge: confirm network connectivity between where the skill runs and the Bridge IP; the Bridge may be only on a local network.
  • For webhooks: validate payload signatures (if available) and ensure your endpoint returns the expected HTTP status code quickly.
  • When access tokens expire, confirm the refresh\_token remains valid and that your refresh job is updating the secret store successfully.

 

Minimal Node.js example (tokened API call inside a stateless skill)

 

// <b>//</b> Minimal example: skill reads access token from env and sends a request to Hue Cloud API
const fetch = require('node-fetch');

async function setLightState(lightId, body) {
  // <b>//</b> In production, read token from secure secret store or env injected by ClawHub
  const ACCESS_TOKEN = process.env.HUE_ACCESS_TOKEN;
  if (!ACCESS_TOKEN) throw new Error('No access token available');

  const url = `https://api.meethue.com/route/to/lights/${encodeURIComponent(lightId)}/state`;
  const res = await fetch(url, {
    method: 'PUT',
    headers: {
      'Authorization': `Bearer ${ACCESS_TOKEN}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify(body)
  });

  if (!res.ok) {
    const errText = await res.text();
    throw new Error(`Hue API error ${res.status}: ${errText}`);
  }
  return res.json();
}

// <b>//</b> Example invocation inside the skill runtime
setLightState('1', { on: true })
  .then(r => console.log('OK', r))
  .catch(e => console.error('ERROR', e.message));

 

Final operational notes

 

  • Be explicit about each piece: OAuth client registration, redirect URIs, secret storage, and token refresh flow. OpenClaw does not “magically” manage external OAuth lifecycles for you — you must wire token issuance and refresh into your deployment plan.
  • Separate ephemeral agent work from durable systems: use the agent for immediate, stateless interactions and external services for persistence, scheduling, and inbound webhooks.
  • Follow the Hue API documentation for exact resource paths when you implement your final calls; use the examples above as accurate patterns (local bridge endpoint and OAuth token exchange endpoints are standard).

Book Your Free 30‑Minute Migration Call

Speak one‑on‑one with a senior engineer about your no‑code app, migration goals, and budget. In just half an hour you’ll leave with clear, actionable next steps—no strings attached.

Book a Free Consultation

Troubleshooting Openhue and OpenClaw Integration

1

OpenClaw clawd not discovering OpenHue bridge via mDNS/SSDP — how to troubleshoot?

OpenClaw's clawd failing to find an OpenHue bridge usually means network discovery (mDNS/SSDP) is blocked or the runtime isn't on the same L2 network; you can fix it by validating discovery from the host, enabling multicast/SSDP in the container/runtime, or manually configuring the bridge IP in the skill config and credentials.

 

Troubleshooting steps

 

Check same LAN, multicast/firewall, and that the OpenClaw runtime has L2 access (containers often need --network host or equivalent). Use host tools (avahi-browse, dns-sd, ssdp-client) to confirm the bridge advertises. Inspect clawd/skill logs for discovery timeouts and errors, and if discovery is impossible, set the bridge IP/username explicitly in the skill config via ClawHub or env vars. Also verify bridge firmware and power.

2

Clawctl pairing with OpenHue fails with "401 Unauthorized" or "invalid token" — how to create and configure Hue API token in claw-config.yaml?

 

Direct answer

 

Generate a Hue API username on your Hue Bridge by pressing its link button and POSTing to /api; use that returned username as the Hue token. Put the token into your OpenClaw credential store (preferably as an environment variable) and reference it from claw-config.yaml. Common pattern: export HUE_USERNAME=the-username and reference ${HUE_USERNAME} in claw-config.yaml so agents read it at runtime.

 

How to do it

 

Steps and checks:

  • Find bridge IP on network
  • Press bridge link button, then create username:
curl -X POST http://BRIDGE_IP/api -d '{"devicetype":"openclaw#agent"}'

Response contains "username". Then set env and config:

# claw-config.yaml
credentials:
  hue:
    api_token: "${HUE_USERNAME}"
  • Ensure agent can read env var and that token matches bridge response; 401 means wrong token or wrong bridge IP.

3

OpenClaw Hue adapter (claw-adapter-hue) state changes from OpenHue not reflected in ClawDevice registry or clawctl list — how to debug sync issues?

 

Direct answer

 

Most of the time this happens because the Hue adapter either isn’t receiving OpenHue events or it can’t write updates into the ClawDevice registry (auth/ID mapping/permissions). Start by confirming event delivery and adapter logs, then verify the adapter’s credentials and registry write permission, and finally reconcile device IDs between OpenHue and ClawDevice.

 

Practical debug checklist

 
  • Check adapter logs for webhook/poll errors, mapping failures, or permission denials.
  • Confirm OpenHue events arrive (use curl or traffic inspector) and payloads contain expected IDs.
  • Verify credentials (env vars/API key/OAuth) used by claw-adapter-hue have registry write rights.
  • Validate ID mapping—ensure adapter maps OpenHue IDs to ClawDevice IDs consistently.
  • Force a reconcile or restart adapter and watch skill execution traces in runtime logs.
  • Network & retries: check timeouts, TLS, and retry/backoff logs.

4

Device ID/entity collisions when importing OpenHue lights into OpenClaw ClawBridge/EntityMapping — how to remap or resolve duplicate entity IDs?

Direct answer: Resolve duplicate OpenHue device/entity collisions by creating explicit EntityMapping entries in ClawBridge that map each incoming light to a unique entity ID (for example prefix with the bridge serial or MAC) and by using stable source keys (bridge-id + hue-light-id). Persist the mapping, restart the bridge import, and verify via logs so IDs don’t auto-conflict on future syncs.

 

Practical steps

 
  • Check ClawBridge import/logs to identify colliding IDs.
  • Pick a stable key (bridge serial, MAC, or bridge-id+light-id).
  • Create persistent EntityMapping records that remap source → unique entity IDs.
  • Reload/redeploy ClawBridge, confirm mapped IDs appear and logs show no collisions.
  • Update downstream systems to use new IDs and keep mapping under version control.
Book a Free Consultation

Still stuck?
Copy this prompt into ChatGPT and get a clear, personalized explanation.

This prompt helps an AI assistant understand your setup and guide you through the fix step by step, without assuming technical knowledge.

AI AI Prompt


Recognized by the best

Trusted by 600+ businesses globally

From startups to enterprises and everything in between, see for yourself our incredible impact.

RapidDev was an exceptional project management organization and the best development collaborators I've had the pleasure of working with.

They do complex work on extremely fast timelines and effectively manage the testing and pre-launch process to deliver the best possible product. I'm extremely impressed with their execution ability.

Arkady
CPO, Praction
Working with Matt was comparable to having another co-founder on the team, but without the commitment or cost.

He has a strategic mindset and willing to change the scope of the project in real time based on the needs of the client. A true strategic thought partner!

Donald Muir
Co-Founder, Arc
RapidDev are 10/10, excellent communicators - the best I've ever encountered in the tech dev space.

They always go the extra mile, they genuinely care, they respond quickly, they're flexible, adaptable and their enthusiasm is amazing.

Mat Westergreen-Thorne
Co-CEO, Grantify
RapidDev is an excellent developer for custom-code solutions.

We’ve had great success since launching the platform in November 2023. In a few months, we’ve gained over 1,000 new active users. We’ve also secured several dozen bookings on the platform and seen about 70% new user month-over-month growth since the launch.

Emmanuel Brown
Co-Founder, Church Real Estate Marketplace
Matt’s dedication to executing our vision and his commitment to the project deadline were impressive. 

This was such a specific project, and Matt really delivered. We worked with a really fast turnaround, and he always delivered. The site was a perfect prop for us!

Samantha Fekete
Production Manager, Media Production Company
The pSEO strategy executed by RapidDev is clearly driving meaningful results.

Working with RapidDev has delivered measurable, year-over-year growth. Comparing the same period, clicks increased by 129%, impressions grew by 196%, and average position improved by 14.6%. Most importantly, qualified contact form submissions rose 350%, excluding spam.

Appreciation as well to Matt Graham for championing the collaboration!

Michael W. Hammond
Principal Owner, OCD Tech

We put the rapid in RapidDev

Need a dedicated strategic tech and growth partner? Discover what RapidDev can do for your business! Book a call with our team to schedule a free, no-obligation consultation. We’ll discuss your project and provide a custom quote at no cost.Â