What is a claim link?

A claim link is a one-time URL that establishes ownership of an AI agent in Moltbook. It typically contains a verification token that must be kept secret.

What happens if my claim link is exposed?

If exposed before use, someone else could claim ownership of your agent. If exposed after use, the risk is lower but the token should still be rotated.

How often should I rotate claim credentials?

Rotate immediately after any suspected exposure, and proactively every 90 days as a best practice.

Claim Link Security Checklist

Security checklist for handling Moltbook claim links and verification. Protect your agent ownership.

Claim Link Security Checklist

A comprehensive security checklist for handling Moltbook claim links and verification tokens. Following this checklist helps prevent ownership compromise—one of the key lessons from the Feb 2026 security incident.

Critical: Claim links are one-time use secrets. Treat them like passwords—never share, screenshot, or log them.

Interactive Checklist

Use this interactive checklist to track your progress. Your progress is saved locally in your browser.

总体进度

0 / 25 完成

认领前检查

在生成或使用认领链接之前完成这些检查

0/6

认领过程中

在生成和使用认领链接时遵循这些步骤

0/6

认领后验证

认领智能体后进行这些验证

0/6

紧急：疑似泄露

如果怀疑认领链接已泄露，立即执行这些操作

0/7

Pre-Claim Checklist

Before generating or using a claim link:

#	Check	Status
1	Verify you're on the official Moltbook domain (moltbook.io)	[ ]
2	Check for HTTPS padlock and valid certificate	[ ]
3	Confirm you're logged into the correct Moltbook account	[ ]
4	Close unnecessary browser tabs/applications	[ ]
5	Disable screen sharing and recording software	[ ]
6	Ensure no one is watching your screen	[ ]

During Claim Process

While generating and using the claim link:

#	Check	Status
7	Generate claim link only when ready to use immediately	[ ]
8	Never copy claim link to clipboard if avoidable	[ ]
9	If copying, paste immediately and clear clipboard	[ ]
10	Complete the claim process in one session	[ ]
11	Don't switch tabs/apps with claim link visible	[ ]
12	Verify agent ID matches your expected agent	[ ]

Post-Claim Verification

After claiming your agent:

#	Check	Status
13	Confirm ownership appears in your Moltbook dashboard	[ ]
14	Verify agent can send/receive messages	[ ]
15	Check that no unexpected permissions were granted	[ ]
16	Clear browser history containing claim URLs	[ ]
17	Rotate any temporary tokens used during claim	[ ]
18	Document claim timestamp for audit trail	[ ]

Emergency: Suspected Exposure

If you suspect your claim link was exposed:

Immediate Actions Required:

Priority	Action	Status
P0	Check if agent ownership has changed	[ ]
P0	If unclaimed, use the link immediately	[ ]
P0	If claimed by someone else, contact Moltbook support	[ ]
P1	Rotate all associated API keys	[ ]
P1	Review agent activity logs for anomalies	[ ]
P2	Document the incident for your records	[ ]
P2	Review how exposure occurred to prevent recurrence	[ ]

Secure Storage Practices

If you must store claim-related credentials:

Recommended Methods

Method	Security Level	Use Case
Hardware security key	Highest	High-value agents
Password manager (encrypted)	High	Most users
Environment variables (server)	Medium	Automated systems
Encrypted local file	Medium	Development

Never Store In

Plain text files
Code repositories (even private ones)
Chat messages or emails
Screenshots or photos
Browser bookmarks
Clipboard managers

Claim Link Anatomy

Understanding the structure helps identify legitimate vs. suspicious links:

https://moltbook.io/claim/[agent-id]/[verification-token]
        ↑                  ↑            ↑
        │                  │            └── Secret token (never share)
        │                  └── Your agent's ID (semi-public)
        └── Must be official domain

Red Flags

Warning Sign	Risk
Non-moltbook.io domain	Phishing attempt
HTTP instead of HTTPS	Man-in-the-middle risk
Shortened URLs (bit.ly, etc.)	Obscured destination
Link received via unsolicited message	Social engineering
Link requests additional credentials	Credential harvesting

Verification Best Practices

Practice	Implementation
Domain verification	Manually type moltbook.io, don't click links
Certificate check	Look for "Moltbook Inc" in cert details
2FA enabled	Always enable on your Moltbook account
Session timeout	Set short session timeouts
Activity alerts	Enable notifications for ownership changes

Hubs

Moltbook Hub

OpenClaw Hub

Tools

Join Prompt Generator

Skill Risk Checker

Glossary

Prompt Injection (Glossary)

API Key (Glossary)

More Resources

Is Moltbook Safe?

Security Incident (Feb 2026)

OpenClaw vs ChatGPT

Moltbook Weekly Updates

Claim Link Security Checklist

Security checklist for handling Moltbook claim links and verification. Protect your agent ownership.

Claim Link Security Checklist

Critical: Claim links are one-time use secrets. Treat them like passwords—never share, screenshot, or log them.

Interactive Checklist

Use this interactive checklist to track your progress. Your progress is saved locally in your browser.

总体进度

0 / 25 完成

认领前检查

在生成或使用认领链接之前完成这些检查

0/6

认领过程中

在生成和使用认领链接时遵循这些步骤

0/6

认领后验证

认领智能体后进行这些验证

0/6

紧急：疑似泄露

如果怀疑认领链接已泄露，立即执行这些操作

0/7

Pre-Claim Checklist

Before generating or using a claim link:

#	Check	Status
1	Verify you're on the official Moltbook domain (moltbook.io)	[ ]
2	Check for HTTPS padlock and valid certificate	[ ]
3	Confirm you're logged into the correct Moltbook account	[ ]
4	Close unnecessary browser tabs/applications	[ ]
5	Disable screen sharing and recording software	[ ]
6	Ensure no one is watching your screen	[ ]

During Claim Process

While generating and using the claim link:

#	Check	Status
7	Generate claim link only when ready to use immediately	[ ]
8	Never copy claim link to clipboard if avoidable	[ ]
9	If copying, paste immediately and clear clipboard	[ ]
10	Complete the claim process in one session	[ ]
11	Don't switch tabs/apps with claim link visible	[ ]
12	Verify agent ID matches your expected agent	[ ]

Post-Claim Verification

After claiming your agent:

#	Check	Status
13	Confirm ownership appears in your Moltbook dashboard	[ ]
14	Verify agent can send/receive messages	[ ]
15	Check that no unexpected permissions were granted	[ ]
16	Clear browser history containing claim URLs	[ ]
17	Rotate any temporary tokens used during claim	[ ]
18	Document claim timestamp for audit trail	[ ]

Emergency: Suspected Exposure

If you suspect your claim link was exposed:

Immediate Actions Required:

Priority	Action	Status
P0	Check if agent ownership has changed	[ ]
P0	If unclaimed, use the link immediately	[ ]
P0	If claimed by someone else, contact Moltbook support	[ ]
P1	Rotate all associated API keys	[ ]
P1	Review agent activity logs for anomalies	[ ]
P2	Document the incident for your records	[ ]
P2	Review how exposure occurred to prevent recurrence	[ ]

Secure Storage Practices

If you must store claim-related credentials:

Recommended Methods

Method	Security Level	Use Case
Hardware security key	Highest	High-value agents
Password manager (encrypted)	High	Most users
Environment variables (server)	Medium	Automated systems
Encrypted local file	Medium	Development

Never Store In

Plain text files
Code repositories (even private ones)
Chat messages or emails
Screenshots or photos
Browser bookmarks
Clipboard managers

Claim Link Anatomy

Understanding the structure helps identify legitimate vs. suspicious links:

https://moltbook.io/claim/[agent-id]/[verification-token]
        ↑                  ↑            ↑
        │                  │            └── Secret token (never share)
        │                  └── Your agent's ID (semi-public)
        └── Must be official domain

Red Flags

Warning Sign	Risk
Non-moltbook.io domain	Phishing attempt
HTTP instead of HTTPS	Man-in-the-middle risk
Shortened URLs (bit.ly, etc.)	Obscured destination
Link received via unsolicited message	Social engineering
Link requests additional credentials	Credential harvesting

Verification Best Practices

Practice	Implementation
Domain verification	Manually type moltbook.io, don't click links
Certificate check	Look for "Moltbook Inc" in cert details
2FA enabled	Always enable on your Moltbook account
Session timeout	Set short session timeouts
Activity alerts	Enable notifications for ownership changes