TL;DR
On April 4, 2026, Anthropic updated its Consumer Terms of Service. OAuth tokens from Free/Pro/Max plans cannot be reused inside third-party tools. OpenClaw, which piggy-backed on subscription tokens, broke. Its creator was temporarily banned from Claude.
If you had cron jobs running on OpenClaw, this guide gets you to a working Nestor setup in a week — BYOK from day 1, no ToS grey zone, full audit trail.
Nestor is MIT, open-source, and architected so this can never happen to you again. Your API keys, your direct billing relationship with Anthropic, your data on your hardware.
What happened on April 4
Date: 2026-04-04, ~12:00 PT.
Anthropic updated its Consumer Terms of Service to explicitly prohibit reusing OAuth tokens from Claude Free, Pro, and Max subscriptions inside third-party tools. Direct API key usage (BYOK) was explicitly allowed.
Coverage: TechCrunch, VentureBeat, and the Anthropic support page all carried details.
OpenClaw, which used subscription OAuth tokens as auth headers for Anthropic API calls, broke the same day. No grace period, no migration tooling provided. Its creator was temporarily banned from accessing Claude six days later.
Why OpenClaw stopped working
- Architecture flaw: OpenClaw reused subscription OAuth tokens as if they were API tokens. This worked until Anthropic added server-side validation tying subscription tokens to first-party clients.
- No recourse: subscription terms don't promise API-equivalent access. OpenClaw's users had no contractual basis to demand restoration.
- Compliance grey zone: even before April 4, this approach lived in legal ambiguity. After April 4, it's explicitly banned.
This isn't a critique of OpenClaw — it was a clever hack that worked for a while. But it was structurally fragile, and structural fragility eventually catches up.
What this means for you
If you're a hobbyist (1-3 cron jobs)
Switch to Claude Free + Claude Code official tool, OR BYOK with a small balance ($5-10/month) on Nestor. Both are ToS-clean and stable.
If you're an indie hacker (side project, 5-15 jobs)
BYOK with $5-20/month budget cap on Nestor. Same cron jobs, transparent costs (you'll actually SEE what each job costs vs OpenClaw hiding it in subscription noise).
If you're a team (production, 20+ jobs)
BYOK + audit log + RBAC on Nestor is required for any serious post-April-4 production use. Compliance teams will not sign off on subscription-token harnesses anymore. Set up multi-tenant from day one.
Migration to Nestor — step by step
Day 0 — Stop OpenClaw cron jobs
Save your job inventory before disabling:
# Export current crontab
crontab -l > openclaw-jobs.txt
# Edit crontab, comment out OpenClaw lines
crontab -e
You now have a record of what was running. We'll port these one by one.
Day 1 — Install Nestor
Single command, interactive wizard:
npx nestor-sh install
The wizard will:
- Detect your environment
- Prompt for API keys (paste your existing
ANTHROPIC_API_KEY— or create one at console.anthropic.com if you only had a subscription) - Encrypt keys with AES-256
- Initialize a local SQLite store under
~/.nestor/ - Generate
.nestor/config.yaml
Day 2 — Migrate first job
Pick the simplest job from your openclaw-jobs.txt. Add it to Nestor:
npx nestor-sh schedule add \
--cron "0 9 * * *" \
--mission "daily-summary" \
--provider anthropic
Verify it runs:
npx nestor-sh schedule list
npx nestor-sh mission run daily-summary # manual trigger to test
Day 3-7 — Migrate remaining jobs
Cron syntax is identical between OpenClaw and Nestor — most schedules transfer 1:1. The audit log at http://localhost:3100/admin/audit captures every run with full attribution: which agent, which model, how many tokens, exact cost, full tool call trace.
Bonus: BYOK billing means you finally SEE your costs per job. OpenClaw hid them in subscription noise.
Bonus — Set budget caps
Edit .nestor/config.yaml:
budget:
daily_usd: 5
per_run_usd: 0.50
hard_cap: true # abort run when reached
warning_pct: 80
You're now protected from runaway costs in a way OpenClaw never offered.
Side-by-side: OpenClaw vs Nestor
OpenClaw flow (post-April-4)
$ openclaw run \
--task "summarize inbox"
ERROR: OAuth token rejected by
Anthropic. Subscription tokens
cannot be used in third-party
clients per ToS update 2026-04-04.
(silent failure mode for cron jobs)
Nestor flow (BYOK)
$ npx nestor-sh mission run \
--name inbox-summary \
--provider anthropic \
--budget 0.50
✓ Mission #042 created
✓ Provider: anthropic (claude-sonnet-4-6)
✓ Budget cap: $0.50
✓ Audit log entry: hash-chained
✓ Cost: $0.31
✓ Report: ./reports/inbox-042.md
Why Nestor is post-April-4 compliant
- BYOK from day 1. No OAuth subscription tokens in the architecture. Ever.
- Direct API keys against Anthropic's API are explicitly allowed by the updated ToS.
- Provider-agnostic: 7 providers (Anthropic, OpenAI, Gemini, Grok, Mistral, Ollama, OpenRouter). All BYOK. All ToS-clean.
- Hash-chained audit log: every API call logged with model, tokens, cost, response hash. If your security team asks "what is your agent sending to Anthropic?", you have the answer.
- MIT-licensed: if Nestor as a project disappears tomorrow, your codebase runs unchanged on your hardware indefinitely. No platform risk.
Refund / credits
OpenClaw's refund policy is outside our control — check their GitHub or community channels.
Nestor's commitment: if you can show your OpenClaw jobs broke on or after 2026-04-04 and need help migrating, we'll help you for free. Open a thread in #migrate-from-openclaw on our Discord.
Try Nestor
npx nestor-sh install
Or browse the quickstart, the configuration reference, or the full changelog.