openclaw - 💡(How to fix) Fix Bug: `cred.key?.trim is not a function` crash after upgrading to 2026.3.31 — env ref auth profiles not fully supported in credential resolution [1 participants]

Bug Report

Describe the bug

After upgrading from 2026.3.28 to 2026.3.31 (which introduced improved env-based secret ref support for model auth profiles), all model-based replies fail with:

``` Agent failed before reply: cred.key?.trim is not a function ```

The error occurs for every model profile — none of them can resolve their API key.

Root cause

In `./dist/models-config-KyFi5MCD.js` (line ~277), the `resolveApiKeyFromCredential(cred)` function handles auth profile credentials like this:

```js function resolveApiKeyFromCredential(cred, env = process.env) { if (cred.type === "api_key") { const keyRef = coerceSecretRef(cred.keyRef); if (keyRef && keyRef.id.trim()) { // env-ref or non-env-ref resolution ... } // FALLBACK — this line crashes when cred.key is not a string: if (cred.key?.trim()) return { apiKey: cred.key, source: "plaintext", discoveryApiKey: toDiscoveryApiKey(cred.key) }; return; } ... } ```

With the new env secret ref format, when a credential profile has:

• `keyRef` set to a valid ref → the first `if` branch is entered correctly
• BUT if the profile was somehow migrated/normalized such that `cred.key` itself became a ref object (e.g. `{ source: "env", id: "SOME_VAR" }`) rather than plain text, the fallback line `cred.key?.trim()` throws because objects have no `.trim()`.

It could also happen when:\n- The auth profile format changes between versions and old `key: { ... }` objects remain in the credential store, while previously `key` was always a string

• The profile store or migration logic writes an object to `cred.key` instead of moving it to `cred.keyRef`

Expected behavior

The credential resolver should guard against non-string values in `cred.key` before calling `.trim()`, or ensure the migration from `key` → `keyRef` format completes so that old object-shaped keys never reach the fallback path.

Proposed fix

```js // current (crashes): if (cred.key?.trim()) return { ... }

// fix: add typeof guard if (typeof cred.key === "string" && cred.key.trim()) return { ... } ```

Or better yet, ensure the credential store migration properly converts any object-valued `key` to `keyRef` so the fallback only ever sees plain strings.

Environment

• openclaw version: 2026.3.31
• Node.js: v22.22.0
• OS: Linux 6.17.0-1009-oracle (arm64)
• Affected providers: All (OpenRouter, DeepSeek, Google, OpenAI Codex, etc.)

Reproduction

1. Run openclaw 2026.3.28 with auth profiles that may contain non-plaintext key values
2. Upgrade to openclaw 2026.3.31\n3. Trigger any model call (e.g. send a message)\n4. Observe `cred.key?.trim is not a function` error

Impact\nCritical — complete inability to resolve any model API key after upgrade. No agent can reply.

Logs

``` openclaw logs --follow\n\n[plugins] matrix: ... (normal)\nAgent failed before reply: cred.key?.trim is not a function ```

Labels: bug, auth, regression, credential-management