Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug]: API Keys REDACTED in every session — agents can't read provider keys

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Bug: API Keys REDACTED in every session — agents can't read any provider keys Environment: OpenClaw version: 2026.5.20 Running on: Linux (self-hosted) Problem: Every time a new session starts, all API keys in openclaw.json are replaced with OPENCLAW_REDACTED. The agent cannot read the actual key values for any provider (Minimax, Bailian, NVIDIA, Lotus, Sensenova, etc.), which means: The agent cannot test or use any model provider without the user re-entering keys manually There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist Even when keys are stored in a separate file on the filesystem, the agent has no way to know which file contains which key Impact: Every session requires the user to re-provide all API keys Agents cannot autonomously run tasks that require model access The "fallback model" mechanism doesn't work because the agent can't see any of the configured keys Expected behavior: The agent should be able to see the configured API keys at runtime, either by: Having the actual key values accessible in the config, or A separate key file that the agent is explicitly told about in system prompt/workspace files Current workaround: Users must manually note which key file (/media/token/ in my case) contains which provider's key, and the agent must be explicitly told the path in every session. This is fragile and not scalable.

Error Message

There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist

Root Cause

Bug: API Keys REDACTED in every session — agents can't read any provider keys Environment: OpenClaw version: 2026.5.20 Running on: Linux (self-hosted) Problem: Every time a new session starts, all API keys in openclaw.json are replaced with OPENCLAW_REDACTED. The agent cannot read the actual key values for any provider (Minimax, Bailian, NVIDIA, Lotus, Sensenova, etc.), which means: The agent cannot test or use any model provider without the user re-entering keys manually There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist Even when keys are stored in a separate file on the filesystem, the agent has no way to know which file contains which key Impact: Every session requires the user to re-provide all API keys Agents cannot autonomously run tasks that require model access The "fallback model" mechanism doesn't work because the agent can't see any of the configured keys Expected behavior: The agent should be able to see the configured API keys at runtime, either by: Having the actual key values accessible in the config, or A separate key file that the agent is explicitly told about in system prompt/workspace files Current workaround: Users must manually note which key file (/media/token/ in my case) contains which provider's key, and the agent must be explicitly told the path in every session. This is fragile and not scalable.

Fix Action

Fix / Workaround

Bug: API Keys REDACTED in every session — agents can't read any provider keys Environment: OpenClaw version: 2026.5.20 Running on: Linux (self-hosted) Problem: Every time a new session starts, all API keys in openclaw.json are replaced with OPENCLAW_REDACTED. The agent cannot read the actual key values for any provider (Minimax, Bailian, NVIDIA, Lotus, Sensenova, etc.), which means: The agent cannot test or use any model provider without the user re-entering keys manually There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist Even when keys are stored in a separate file on the filesystem, the agent has no way to know which file contains which key Impact: Every session requires the user to re-provide all API keys Agents cannot autonomously run tasks that require model access The "fallback model" mechanism doesn't work because the agent can't see any of the configured keys Expected behavior: The agent should be able to see the configured API keys at runtime, either by: Having the actual key values accessible in the config, or A separate key file that the agent is explicitly told about in system prompt/workspace files Current workaround: Users must manually note which key file (/media/token/ in my case) contains which provider's key, and the agent must be explicitly told the path in every session. This is fragile and not scalable.

Bug: API Keys REDACTED in every session — agents can't read any provider keys Environment: OpenClaw version: 2026.5.20 Running on: Linux (self-hosted) Problem: Every time a new session starts, all API keys in openclaw.json are replaced with OPENCLAW_REDACTED. The agent cannot read the actual key values for any provider (Minimax, Bailian, NVIDIA, Lotus, Sensenova, etc.), which means: The agent cannot test or use any model provider without the user re-entering keys manually There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist Even when keys are stored in a separate file on the filesystem, the agent has no way to know which file contains which key Impact: Every session requires the user to re-provide all API keys Agents cannot autonomously run tasks that require model access The "fallback model" mechanism doesn't work because the agent can't see any of the configured keys Expected behavior: The agent should be able to see the configured API keys at runtime, either by: Having the actual key values accessible in the config, or A separate key file that the agent is explicitly told about in system prompt/workspace files Current workaround: Users must manually note which key file (/media/sf_x/k/token/ in my case) contains which provider's key, and the agent must be explicitly told the path in every session. This is fragile and not scalable.

Bug: API Keys REDACTED in every session — agents can't read any provider keys Environment: OpenClaw version: 2026.5.20 Running on: Linux (self-hosted) Problem: Every time a new session starts, all API keys in openclaw.json are replaced with OPENCLAW_REDACTED. The agent cannot read the actual key values for any provider (Minimax, Bailian, NVIDIA, Lotus, Sensenova, etc.), which means: The agent cannot test or use any model provider without the user re-entering keys manually There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist Even when keys are stored in a separate file on the filesystem, the agent has no way to know which file contains which key Impact: Every session requires the user to re-provide all API keys Agents cannot autonomously run tasks that require model access The "fallback model" mechanism doesn't work because the agent can't see any of the configured keys Expected behavior: The agent should be able to see the configured API keys at runtime, either by: Having the actual key values accessible in the config, or A separate key file that the agent is explicitly told about in system prompt/workspace files Current workaround: Users must manually note which key file (/media/sf_x/k/token/ in my case) contains which provider's key, and the agent must be explicitly told the path in every session. This is fragile and not scalable.

RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

Bug: API Keys REDACTED in every session — agents can't read any provider keys Environment: OpenClaw version: 2026.5.20 Running on: Linux (self-hosted) Problem: Every time a new session starts, all API keys in openclaw.json are replaced with OPENCLAW_REDACTED. The agent cannot read the actual key values for any provider (Minimax, Bailian, NVIDIA, Lotus, Sensenova, etc.), which means: The agent cannot test or use any model provider without the user re-entering keys manually There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist Even when keys are stored in a separate file on the filesystem, the agent has no way to know which file contains which key Impact: Every session requires the user to re-provide all API keys Agents cannot autonomously run tasks that require model access The "fallback model" mechanism doesn't work because the agent can't see any of the configured keys Expected behavior: The agent should be able to see the configured API keys at runtime, either by: Having the actual key values accessible in the config, or A separate key file that the agent is explicitly told about in system prompt/workspace files Current workaround: Users must manually note which key file (/media/token/ in my case) contains which provider's key, and the agent must be explicitly told the path in every session. This is fragile and not scalable.

Steps to reproduce

Bug: API Keys REDACTED in every session — agents can't read any provider keys Environment: OpenClaw version: 2026.5.20 Running on: Linux (self-hosted) Problem: Every time a new session starts, all API keys in openclaw.json are replaced with OPENCLAW_REDACTED. The agent cannot read the actual key values for any provider (Minimax, Bailian, NVIDIA, Lotus, Sensenova, etc.), which means: The agent cannot test or use any model provider without the user re-entering keys manually There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist Even when keys are stored in a separate file on the filesystem, the agent has no way to know which file contains which key Impact: Every session requires the user to re-provide all API keys Agents cannot autonomously run tasks that require model access The "fallback model" mechanism doesn't work because the agent can't see any of the configured keys Expected behavior: The agent should be able to see the configured API keys at runtime, either by: Having the actual key values accessible in the config, or A separate key file that the agent is explicitly told about in system prompt/workspace files Current workaround: Users must manually note which key file (/media/sf_x/k/token/ in my case) contains which provider's key, and the agent must be explicitly told the path in every session. This is fragile and not scalable.

Expected behavior

Bug: API Keys REDACTED in every session — agents can't read any provider keys Environment: OpenClaw version: 2026.5.20 Running on: Linux (self-hosted) Problem: Every time a new session starts, all API keys in openclaw.json are replaced with OPENCLAW_REDACTED. The agent cannot read the actual key values for any provider (Minimax, Bailian, NVIDIA, Lotus, Sensenova, etc.), which means: The agent cannot test or use any model provider without the user re-entering keys manually There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist Even when keys are stored in a separate file on the filesystem, the agent has no way to know which file contains which key Impact: Every session requires the user to re-provide all API keys Agents cannot autonomously run tasks that require model access The "fallback model" mechanism doesn't work because the agent can't see any of the configured keys Expected behavior: The agent should be able to see the configured API keys at runtime, either by: Having the actual key values accessible in the config, or A separate key file that the agent is explicitly told about in system prompt/workspace files Current workaround: Users must manually note which key file (/media/sf_x/k/token/ in my case) contains which provider's key, and the agent must be explicitly told the path in every session. This is fragile and not scalable.

Actual behavior

Bug: API Keys REDACTED in every session — agents can't read any provider keys Environment: OpenClaw version: 2026.5.20 Running on: Linux (self-hosted) Problem: Every time a new session starts, all API keys in openclaw.json are replaced with OPENCLAW_REDACTED. The agent cannot read the actual key values for any provider (Minimax, Bailian, NVIDIA, Lotus, Sensenova, etc.), which means: The agent cannot test or use any model provider without the user re-entering keys manually There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist Even when keys are stored in a separate file on the filesystem, the agent has no way to know which file contains which key Impact: Every session requires the user to re-provide all API keys Agents cannot autonomously run tasks that require model access The "fallback model" mechanism doesn't work because the agent can't see any of the configured keys Expected behavior: The agent should be able to see the configured API keys at runtime, either by: Having the actual key values accessible in the config, or A separate key file that the agent is explicitly told about in system prompt/workspace files Current workaround: Users must manually note which key file (/media/sf_x/k/token/ in my case) contains which provider's key, and the agent must be explicitly told the path in every session. This is fragile and not scalable.

OpenClaw version

2026.05.20

Operating system

ubuntu 24

Install method

No response

Model

minimax

Provider / routing chain

openclaw

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

Bug: API Keys REDACTED in every session — agents can't read any provider keys Environment: OpenClaw version: 2026.5.20 Running on: Linux (self-hosted) Problem: Every time a new session starts, all API keys in openclaw.json are replaced with OPENCLAW_REDACTED. The agent cannot read the actual key values for any provider (Minimax, Bailian, NVIDIA, Lotus, Sensenova, etc.), which means: The agent cannot test or use any model provider without the user re-entering keys manually There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist Even when keys are stored in a separate file on the filesystem, the agent has no way to know which file contains which key Impact: Every session requires the user to re-provide all API keys Agents cannot autonomously run tasks that require model access The "fallback model" mechanism doesn't work because the agent can't see any of the configured keys Expected behavior: The agent should be able to see the configured API keys at runtime, either by: Having the actual key values accessible in the config, or A separate key file that the agent is explicitly told about in system prompt/workspace files Current workaround: Users must manually note which key file (/media/sf_x/k/token/ in my case) contains which provider's key, and the agent must be explicitly told the path in every session. This is fragile and not scalable.

Additional information

No response

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Bug: API Keys REDACTED in every session — agents can't read any provider keys Environment: OpenClaw version: 2026.5.20 Running on: Linux (self-hosted) Problem: Every time a new session starts, all API keys in openclaw.json are replaced with OPENCLAW_REDACTED. The agent cannot read the actual key values for any provider (Minimax, Bailian, NVIDIA, Lotus, Sensenova, etc.), which means: The agent cannot test or use any model provider without the user re-entering keys manually There's no error message or indication that keys exist but are masked — the agent just sees empty/redacted values and assumes the keys don't exist Even when keys are stored in a separate file on the filesystem, the agent has no way to know which file contains which key Impact: Every session requires the user to re-provide all API keys Agents cannot autonomously run tasks that require model access The "fallback model" mechanism doesn't work because the agent can't see any of the configured keys Expected behavior: The agent should be able to see the configured API keys at runtime, either by: Having the actual key values accessible in the config, or A separate key file that the agent is explicitly told about in system prompt/workspace files Current workaround: Users must manually note which key file (/media/sf_x/k/token/ in my case) contains which provider's key, and the agent must be explicitly told the path in every session. This is fragile and not scalable.

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix [Bug]: API Keys REDACTED in every session — agents can't read provider keys