openclaw - 💡(How to fix) Fix [Bug]: Anthropic API key pasted via wizard is registered under provider `claude` (orphan), silently falling back to OAuth — needs sync-fix in 2 JSON files

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

Pasting a real Anthropic API key (sk-ant-api03-…) through the interactive auth wizard registers it under provider claude (profile id claude:manual) instead of provider anthropic (anthropic:manual). Because anthropic/* models only consider anthropic:* profiles, the key becomes orphan and the agent silently falls back to the anthropic:claude-cli OAuth profile (which has its own billing wall for non-Pro/Max-eligible third-party calls). Net effect: user pastes a paid API key, gets "out of extra usage" errors anyway.

Steps to reproduce

1. Have a valid Anthropic API key from console.anthropic.com (sk-ant-api03-…).
2. Run the interactive auth wizard (e.g. openclaw configure, openclaw onboard, or openclaw models auth add flow).
3. When prompted to choose a provider for the pasted token, select / accept the default for "Claude" (the wizard's natural-language label).
4. Token gets stored as profile id claude:manual with provider: "claude".
5. Set default model openclaw models set anthropic/claude-sonnet-4-6.
6. Send any prompt in the TUI.

Expected behavior

Either:

• (a) The wizard auto-detects the sk-ant-api03- prefix and registers under provider: "anthropic" (id anthropic:manual), OR
• (b) The wizard explicitly warns "Claude (Anthropic API)" with a sentence like "This token will be used for models under the anthropic/ namespace", OR
• (c) The claude provider is an alias of anthropic for token-resolution purposes, so claude:manual is consulted when serving anthropic/* models.

Actual behavior

• Profile is registered as claude:manual (provider claude).
• Gateway sees profileCount: 1 for the anthropic provider (only anthropic:claude-cli OAuth).
• All requests for anthropic/claude-sonnet-4-6 (or any anthropic model) hit the OAuth profile, which immediately returns "You're out of extra usage" (because the OAuth credential is bound to the user's claude.ai subscription, and OpenClaw-routed calls land in the "extras" billing bucket — see related #83234 / earlier diagnosis).
• The expensive sk-ant-api03- API key just sits unused.

Log snippet (anonymized) showing the silent fallback:

warn model-fallback/decision {"event":"model_fallback_decision","decision":"probe_cooldown_candidate",
  "requestedProvider":"anthropic","requestedModel":"claude-sonnet-4-6",
  "candidateProvider":"anthropic","candidateModel":"claude-sonnet-4-6",
  "reason":"billing","profileCount":1}            ← only one anthropic profile visible
info  agents/auth-profiles {"type":"oauth"} read anthropic credentials from claude cli keychain
warn  agent/embedded {"event":"embedded_run_agent_end","isError":true,
  "error":"LLM request rejected: You're out of extra usage. Add more at claude.ai/settings/usage and keep going.",
  "model":"claude-sonnet-4-6","provider":"anthropic"}

Workaround that works (but should not be required)

The profile lives in two files that both need to be edited consistently:

1. ~/.openclaw/agents/main/agent/auth-profiles.json — token storage. Rename the claude:manual key to anthropic:manual AND change the inner "provider": "claude" field to "provider": "anthropic".
2. ~/.openclaw/openclaw.json — auth.profiles registry mestre. Same rename, same provider field change.

Then openclaw gateway restart. After that, openclaw models auth list shows the profile correctly bucketed under anthropic and profileCount becomes 2.

Editing only one of the two files (especially #1) is insufficient — the gateway picks up the rename in the storage file but the master registry in openclaw.json still classifies the profile as claude, so the gateway still sees profileCount: 1 for anthropic.

OpenClaw version

2026.5.12 (f066dd2)

Operating system

macOS 15.x (Darwin 25.4.0)

Install method

npm i -g openclaw@latest (prefix ~/.npm-global)

Model

anthropic/claude-sonnet-4-6

Provider / routing chain

openclaw embedded → anthropic API (direct, via api.anthropic.com)

Additional provider/model setup details

• auth.profiles BEFORE manual fix in ~/.openclaw/openclaw.json:

  {
    "anthropic:claude-cli": { "mode": "oauth",  "provider": "claude-cli" },
    "claude:manual":        { "mode": "token",  "provider": "claude"     },
    "google:manual":        { "mode": "token",  "provider": "google"     }
  }

• After manual fix:

  {
    "anthropic:claude-cli": { "mode": "oauth",  "provider": "claude-cli" },
    "anthropic:manual":     { "mode": "token",  "provider": "anthropic"  },
    "google:manual":        { "mode": "token",  "provider": "google"     }
  }

Logs, screenshots, and evidence

See log snippet above (taken from openclaw logs --plain --limit 200). Full session logs available on request.

Impact and severity

Medium-high. Affects any user who:

• Has hit the OAuth/claude.ai "out of extra usage" wall (very common on Pro/Max plans where OpenClaw-routed Anthropic calls land in the extras bucket), AND
• Followed the documented path of adding a direct Anthropic API key as remediation.

These users will paste a valid paid API key, see the gateway silently keep using the OAuth profile, and get the same billing error — making it look like the API key was rejected when actually it was never used. There's no surfaced warning in models status, models auth list, or doctor flagging the orphan profile.

Suggested fix

Pick one or more:

1. Auto-detect on paste: if pasted token matches ^sk-ant-api03- (or similar known prefixes), default --provider anthropic regardless of wizard label.
2. Single source of truth: deduplicate auth.profiles between openclaw.json and agents/<id>/agent/auth-profiles.json. Two files holding the same logical registry that must stay in sync is a footgun.
3. openclaw doctor rule: flag any profile whose provider field has no matching * model in the model registry (orphan profile detection). Today doctor silently misses this.
4. Rename profile flow: provide openclaw models auth rename <old-id> <new-id> --provider <new-provider> so the workaround above doesn't require editing two JSON files by hand.

Related

• Companion to #83234 (scope upgrade race) — the OAuth profile's billing failure is what made Daniel try the API-key path in the first place.