Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix Anthropic setup-token (sk-ant-oat01) returns 401 Invalid bearer token in 2026.3.23-2 [1 pull requests, 3 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#54350•Fetched 2026-04-08 01:28:38
View on GitHub
Comments
3
Participants
3
Timeline
5
Reactions
0
Author
gleeson777-sudogleeson777-sudo
Participants
gleeson777-sudogleeson777-sudosnesan821snesan821steipetesteipete
Timeline (top)
commented ×3cross-referenced ×1referenced ×1

Error Message

2026-03-25T07:27:01.627Z warn agent/embedded embedded_run_agent_end isError=true model=claude-haiku-4-5 provider=anthropic error="HTTP 401 authentication_error: Invalid bearer token" requestIdHash=sha256:023aa7351222 2026-03-25T07:27:01.851Z warn agent/embedded embedded_run_agent_end isError=true model=claude-haiku-4-5 provider=anthropic error="HTTP 401 authentication_error: Invalid bearer token" requestIdHash=sha256:85a2b889f797 2026-03-25T07:27:12.929Z warn agent/embedded embedded_run_agent_end isError=true model=claude-haiku-4-5 provider=anthropic error="HTTP 401 authentication_error: Invalid bearer token" requestIdHash=sha256:0c271fd5a66c 2026-03-25T07:28:56.254Z warn agent/embedded embedded_run_agent_end isError=true model=claude-sonnet-4-6 provider=anthropic error="HTTP 401 authentication_error: Invalid bearer token" requestIdHash=sha256:eef096e2cc22 2026-03-25T07:29:02.599Z warn agent/embedded embedded_run_agent_end isError=true model=claude-sonnet-4-6 provider=anthropic error="HTTP 401 authentication_error: Invalid bearer token" requestIdHash=sha256:78c6f974ab71

Fix Action

Fixed

PR fix notes

PR #54393: fix(providers/anthropic): support OAuth tokens (sk-ant-oat01-) (#54350)

Description (problem / solution / changelog)

fix(providers/anthropic): support OAuth tokens (sk-ant-oat01-) (#54350)

Summary

  • Problem: The Anthropic provider was defaulting to the x-api-key header for all tokens, causing a 401 authentication_error when using newer OAuth setup-tokens (sk-ant-oat01-).
  • Why it matters: Users with Claude Pro/Max subscriptions via setup-tokens were completely blocked from model execution in the current release.
  • What changed: Implemented a wrapStreamFn in the Anthropic extension to intercept headers and dynamically switch to the Authorization: Bearer protocol when an OAuth prefix is detected.
  • What did NOT change: Traditional API key handling (sk-ant-api-) remains untouched to ensure zero breaking changes for existing users.

Change Type (select all)

  • Bug fix
  • Feature
  • Refactor required for the fix
  • Docs
  • Security hardening
  • Chore/infra

Scope (select all touched areas)

  • Gateway / orchestration
  • Skills / tool execution
  • Auth / tokens
  • Memory / storage
  • Integrations
  • API / contracts
  • UI / DX
  • CI/CD / infra

Linked Issue/PR

  • Closes #54350
  • This PR fixes a bug or regression

Root Cause / Regression History

  • Root cause: The provider assumed a monolithic x-api-key authentication strategy, failing to account for the OAuth 2.0 Bearer standard required by the sk-ant-oat token family.
  • Why this regressed now: The recent 2026.3.23-2 release increased enforcement of strict header validation on the Anthropic gateway, exposing this protocol mismatch.

Regression Test Plan

  • Coverage level that should have caught this:
    • Unit test
  • Target test or file: extensions/anthropic/oauth-auth.test.ts
  • Scenario the test should lock in: Verification that OAuth-prefixed tokens trigger Bearer auth while standard keys maintain x-api-key headers.
  • Why this is the smallest reliable guardrail: It validates the header construction logic before any network calls are dispatched.

User-visible / Behavior Changes

  • None. Fix is transparent for all users.

Security Impact (required)

  • New permissions/capabilities? (No)
  • Secrets/tokens handling changed? (Yes)
  • New/changed network calls? (No)
  • Command/tool execution surface changed? (No)
  • Data access scope changed? (No)
  • Explanation: Updated token handling to correctly implement the Bearer protocol for OAuth flows.

Repro + Verification

Environment

  • OS: macOS 26.3.1 (arm64)
  • Runtime: Node 22.22.1 / pnpm 10.32.1
  • Model/provider: Claude 4.5 / Anthropic

Steps

  1. Configure an Anthropic profile with an sk-ant-oat01- token.
  2. Attempt a model run (e.g., openclaw prompt "hello").

Expected

Successful authentication and stream start.

Actual

HTTP 401 authentication_error: Invalid bearer token.

Evidence

  • Failing test/log before + passing after (See issue #54350)
  • Trace/log snippets
  • Verified via pnpm test extensions/anthropic/oauth-auth.test.ts

Human Verification (required)

  • Verified scenarios: 1. sk-ant-oat01- results in Bearer auth. 2. sk-ant-api- maintains legacy x-api-key.
  • Edge cases checked: Version header persistence and empty token handling.
  • What you did NOT verify: Live token handshake (mocked at the header-construction level).

Review Conversations

  • I replied to or resolved every bot review conversation I addressed in this PR.

Compatibility / Migration

  • Backward compatible? (Yes)
  • Config/env changes? (No)
  • Migration needed? (No)

Failure Recovery

  • How to disable/revert this change quickly: Revert commit and restore extensions/anthropic/index.ts.
  • Known bad symptoms: 401s returning for all Anthropic keys (unlikely due to regex gating).

Risks and Mitigations

  • Risk: Potential regex collision with future Anthropic token formats.
  • Mitigation: Used a conservative startsWith check on the verified sk-ant-oat prefix.

Changed files

  • CHANGELOG.md (modified, +1/-0)
  • extensions/anthropic/index.ts (modified, +27/-0)
  • extensions/anthropic/oauth-auth.test.ts (added, +138/-0)
RAW_BUFFERClick to expand / collapse

OpenClaw 2026.3.23-2 (7ffe7e4) on macOS 26.3.1 (arm64) Node 22.22.1 Claude models via Anthropic provider fail with HTTP 401 authentication_error: Invalid bearer token. Auth profile uses Anthropic setup-token (Claude Pro) with prefix sk-ant-oat01-, length 90, no whitespace/newlines. Selected profile: anthropic:default (type: token)

Log excerpts (/tmp/openclaw/openclaw-2026-03-25.log): 2026-03-25T07:27:01.627Z warn agent/embedded embedded_run_agent_end isError=true model=claude-haiku-4-5 provider=anthropic error="HTTP 401 authentication_error: Invalid bearer token" requestIdHash=sha256:023aa7351222 2026-03-25T07:27:01.851Z warn agent/embedded embedded_run_agent_end isError=true model=claude-haiku-4-5 provider=anthropic error="HTTP 401 authentication_error: Invalid bearer token" requestIdHash=sha256:85a2b889f797 2026-03-25T07:27:12.929Z warn agent/embedded embedded_run_agent_end isError=true model=claude-haiku-4-5 provider=anthropic error="HTTP 401 authentication_error: Invalid bearer token" requestIdHash=sha256:0c271fd5a66c 2026-03-25T07:28:56.254Z warn agent/embedded embedded_run_agent_end isError=true model=claude-sonnet-4-6 provider=anthropic error="HTTP 401 authentication_error: Invalid bearer token" requestIdHash=sha256:eef096e2cc22 2026-03-25T07:29:02.599Z warn agent/embedded embedded_run_agent_end isError=true model=claude-sonnet-4-6 provider=anthropic error="HTTP 401 authentication_error: Invalid bearer token" requestIdHash=sha256:78c6f974ab71 ... (repeats)

extent analysis

Fix Plan

The fix involves updating the authentication token for the Anthropic provider.

  • Check the Anthropic dashboard for any updates or rotations of the setup-token.
  • Verify that the token prefix sk-ant-oat01- is correct and the token length is 90 characters.
  • Update the auth profile with the new token, if necessary.

Example code to update the auth profile:

// Update the auth profile with the new token
const newToken = 'sk-ant-oat01-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
const authProfile = {
  type: 'token',
  token: newToken
};

// Save the updated auth profile
saveAuthProfile(authProfile);

Verification

To verify that the fix worked:

  • Restart the OpenClaw service.
  • Run a test query using the Claude model via the Anthropic provider.
  • Check the logs for any authentication errors.

Example test query:

// Test query using the Claude model
const model = 'claude-haiku-4-5';
const provider = 'anthropic';
const query = 'Test query';

// Run the test query
runQuery(model, provider, query)
  .then((response) => {
    console.log(response);
  })
  .catch((error) => {
    console.error(error);
  });

Extra Tips

  • Make sure to handle token rotations and updates properly to avoid authentication errors.
  • Consider implementing a token refresh mechanism to automatically update the token when it expires.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#prompt issue#agent setup#task chaining#parallel task#integration issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING