openclaw - ✅(Solved) Fix [Bug]: Anthropic auth rejects valid sk-ant-api03 API keys [1 pull requests, 1 comments, 2 participants]

openclaw2026-04-26 10:58:02

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#72121•Fetched 2026-04-27 05:34:35

View on GitHub

Comments

Participants

Timeline

Reactions

Author

daniel-bellatechnologies

Participants

clawsweeper[bot]

daniel-bellatechnologies

Timeline (top)

referenced ×2commented ×1cross-referenced ×1

openclaw models auth paste-token --provider anthropic rejects a valid standard Anthropic API key with the sk-ant-api03-... prefix and reports that it expected sk-ant-oat01-....

Error Message

Observe the validation error.

Root Cause

openclaw models auth paste-token --provider anthropic rejects a valid standard Anthropic API key with the sk-ant-api03-... prefix and reports that it expected sk-ant-oat01-....

Fix Action

Fixed

Fixed by PR: fix(models/auth): accept sk-ant-api03 API keys in paste-token (#72121) (https://github.com/openclaw/openclaw/pull/72124)

PR fix notes

PR #72124: fix(models/auth): accept sk-ant-api03 API keys in paste-token (#72121)

Repository: openclaw/openclaw
Author: hclsys
State: open | merged: False
Link: https://github.com/openclaw/openclaw/pull/72124

Description (problem / solution / changelog)

Summary

Fixes #72121.

`openclaw models auth paste-token --provider anthropic` rejects valid Anthropic API keys with the standard `sk-ant-api03-` prefix and prints:

``` Expected token starting with sk-ant-oat01- ```

Both `sk-ant-oat01-` (OAuth setup tokens) and `sk-ant-api03-` (standard API keys) are documented Anthropic credential families. The CLI should accept both via paste-token.

Fix: `validateAnthropicSetupToken` now accepts either prefix via the new `ANTHROPIC_TOKEN_PREFIXES` array. The validation error lists both prefixes. The too-short error is tailored per matched prefix family for accuracy.

Pre-implement audit (skill v6 rules)

Rule	Status	Notes
Existing-helper check	PASS	Extending the existing `validateAnthropicSetupToken` validator and reusing `ANTHROPIC_SETUP_TOKEN_MIN_LENGTH`; no parallel validator introduced
Shared-helper-caller check	PASS	One external call site at `src/commands/models/auth.ts:406`; contract widened additively (sk-ant-oat01- input still accepted)
Broader-fix-rival scan	PASS	No rival PR for #72121

Test plan

12 new tests in `src/plugins/provider-auth-token.test.ts` covering:
- Both prefix families pass full-length validation
- Empty / whitespace-only input → "Required"
- Unknown prefix → error mentions both supported prefixes
- Too-short input → tailored "setup-token" vs "API key" hint
- Leading/trailing whitespace trimmed before validation
- `ANTHROPIC_TOKEN_PREFIXES` enumerates both prefixes in order
- Boundary at `ANTHROPIC_SETUP_TOKEN_MIN_LENGTH` accepts both
`pnpm exec vitest run src/plugins/provider-auth-token.test.ts` — 12/12 pass
`pnpm exec vitest run src/commands/auth-choice.test.ts src/commands/models/auth.test.ts` — 26/26 pass (no regression in callers)
`pnpm exec oxfmt --check` — clean
`pnpm exec oxlint` — 0 warnings/errors
CI green

Files

file	+	−
`CHANGELOG.md`	1	0
`src/plugins/provider-auth-token.ts`	19	3
`src/plugins/provider-auth-token.test.ts`	86	0 (new)

Changed files

CHANGELOG.md (modified, +1/-0)
src/plugins/provider-auth-token.test.ts (added, +89/-0)
src/plugins/provider-auth-token.ts (modified, +16/-3)

Code Example

openclaw models auth paste-token --provider anthropic --profile-id anthropic:default

---

sk-ant-api03-...

---

Expected token starting with sk-ant-oat01-

---

$ openclaw models auth paste-token --provider anthropic --profile-id anthropic:default
# pasted a valid Anthropic API key beginning with sk-ant-api03-...
Expected token starting with sk-ant-oat01-

---

$ openclaw models auth paste-token --help
Usage: openclaw models auth paste-token [options]

Paste a token into auth-profiles.json and update config

Options:
  --expires-in <duration>  Optional expiry duration (e.g. 365d, 12h). Stored as absolute expiresAt.
  -h, --help               Display help for command
  --profile-id <id>        Auth profile id (default: <provider>:manual)
  --provider <name>        Provider id (e.g. anthropic)

RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

Summary

openclaw models auth paste-token --provider anthropic rejects a valid standard Anthropic API key with the sk-ant-api03-... prefix and reports that it expected sk-ant-oat01-....

Steps to reproduce

On OpenClaw 2026.4.23 (a979721), configure Anthropic as a model/fallback target, e.g. anthropic/claude-sonnet-4.5.

Run:

openclaw models auth paste-token --provider anthropic --profile-id anthropic:default

Paste a valid Anthropic API key beginning with:
```
sk-ant-api03-...
```
Observe the validation error.

Expected behavior

OpenClaw should accept and store a standard Anthropic API key with the sk-ant-api03-... prefix for the anthropic provider, or clearly provide a separate API-key auth path if paste-token is intentionally only for sk-ant-oat01-... setup/OAuth-style tokens.

Actual behavior

The CLI rejects the key and prints:

Expected token starting with sk-ant-oat01-

OpenClaw version

2026.4.23 (a979721)

Operating system

Linux 6.8.0-87-generic x64

Install method

npm global CLI / OpenClaw Gateway on headless Linux host

Model

anthropic/claude-sonnet-4.5

Provider / routing chain

OpenClaw -> Anthropic provider

Additional provider/model setup details

Default model in this environment: openai/gpt-5.5
Intended fallback model: anthropic/claude-sonnet-4.5
openclaw models status --json reported anthropic under auth.missingProvidersInUse before attempting auth.
The real API key was not included here; only the prefix sk-ant-api03-... is shown.

Logs, screenshots, and evidence

$ openclaw models auth paste-token --provider anthropic --profile-id anthropic:default
# pasted a valid Anthropic API key beginning with sk-ant-api03-...
Expected token starting with sk-ant-oat01-

Related current CLI surface:

$ openclaw models auth paste-token --help
Usage: openclaw models auth paste-token [options]

Paste a token into auth-profiles.json and update config

Options:
  --expires-in <duration>  Optional expiry duration (e.g. 365d, 12h). Stored as absolute expiresAt.
  -h, --help               Display help for command
  --profile-id <id>        Auth profile id (default: <provider>:manual)
  --provider <name>        Provider id (e.g. anthropic)

Impact and severity

Affected users/systems/channels: users configuring Anthropic as a model provider or fallback provider via the CLI auth flow.
Severity: blocks workflow for configuring anthropic/claude-sonnet-4.5 with a standard Anthropic API key.
Frequency: observed every time with a standard sk-ant-api03-... key.
Consequence: Anthropic remains listed as missing auth, so the fallback model cannot be used through this setup path.

Additional information

There was a previous closed issue for this exact validation message (#39423), but this is still reproducible on OpenClaw 2026.4.23 (a979721) with a standard Anthropic sk-ant-api03-... API key.

extent analysis

TL;DR

The issue can be resolved by updating the authentication logic to accept Anthropic API keys with the sk-ant-api03-... prefix.

Guidance

Verify that the Anthropic API key is correctly formatted and valid by checking the official Anthropic documentation.
Check the OpenClaw documentation to see if there are any specific requirements or restrictions for Anthropic API keys.
Consider filing a bug report or feature request to update the OpenClaw authentication logic to accept sk-ant-api03-... prefixed keys.
If possible, test the authentication flow with a different Anthropic API key or a different provider to isolate the issue.

Example

No code snippet is provided as the issue is related to the OpenClaw CLI and Anthropic API key validation.

Notes

The issue seems to be a regression, as a previous issue (#39423) was closed, but the problem still persists. It's essential to investigate and update the authentication logic to accept the correct prefix.

Recommendation

Apply a workaround by manually updating the authentication configuration or waiting for an update to the OpenClaw CLI that fixes the issue, as the current version (2026.4.23) does not support sk-ant-api03-... prefixed keys.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

FAQ

Expected behavior

#api #generation error #database connection #vector store #embedding generation

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

openclaw - ✅(Solved) Fix [Bug]: Anthropic auth rejects valid sk-ant-api03 API keys [1 pull requests, 1 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fixed

PR fix notes

PR #72124: fix(models/auth): accept sk-ant-api03 API keys in paste-token (#72121)

Description (problem / solution / changelog)

Summary

Pre-implement audit (skill v6 rules)

Test plan

Files

Changed files

Code Example

Bug type

Beta release blocker

Summary

Steps to reproduce

Expected behavior

Actual behavior

OpenClaw version

Operating system

Install method

Model

Provider / routing chain

Additional provider/model setup details

Logs, screenshots, and evidence

Impact and severity

Additional information

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

FAQ

Expected behavior

Still need to ship something?

RELATED_DISCOVERY

TRENDING