Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Auth loader: support env var references in auth-profiles.json token fields

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

This is the unblock for SEC-003 (hardcoded secrets audit). Ref: internal security hardening pass, May 2026.

Root Cause

This is the unblock for SEC-003 (hardcoded secrets audit). Ref: internal security hardening pass, May 2026.

Fix Action

Fix / Workaround

Interim mitigation: File permissions tightened to 600 (root-only). This limits exposure but doesn't eliminate the plaintext-on-disk risk.

Code Example

{
  "token": "sk-ant-oat01-XXXX..."
}

---

{
  "token": "${ANTHROPIC_API_KEY_DEFAULT}"
}
RAW_BUFFERClick to expand / collapse

Problem

Agent auth-profiles.json files (under agents/*/agent/auth-profiles.json) store API tokens as plaintext strings. There are 7 agent profiles with 36 hardcoded credentials across Anthropic and OpenAI providers.

Current format:

{
  "token": "sk-ant-oat01-XXXX..."
}

These files are runtime config read directly by the OpenClaw auth loader — there is no mechanism to reference environment variables or external secret stores.

Interim mitigation: File permissions tightened to 600 (root-only). This limits exposure but doesn't eliminate the plaintext-on-disk risk.

Proposed fix

Add env var resolution in the auth loader so token fields can use ${ENV_VAR} syntax:

{
  "token": "${ANTHROPIC_API_KEY_DEFAULT}"
}

The loader should resolve ${...} references from process.env at profile load time, falling back to the literal string if no env var is set (preserving backward compat).

Scope: Only the token, access, and refresh fields in auth-profiles.json need resolution — no other config fields.

Context

This is the unblock for SEC-003 (hardcoded secrets audit). Ref: internal security hardening pass, May 2026.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix Auth loader: support env var references in auth-profiles.json token fields