openclaw - 💡(How to fix) Fix [Bug]: Discord: SecretRef named account token still unresolved at channel startup (2026.5.3) [5 comments, 2 participants]

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

SecretRef token for named Discord account fails to resolve at channel startup despite fix in #76987

Steps to reproduce

1. Configure a named Discord account (not default) with a SecretRef token in openclaw.json
2. Add secrets provider with source "env" and alias "default"
3. Set the env variable in secrets.env and source it via ~/.bashrc with set -a
4. Start the gateway via systemd user service
5. Observe that the Discord channel fails to start

Expected behavior

Discord channel should start successfully and connect to the Discord gateway, with the SecretRef token resolved from the env provider at startup, as stated in the fix #76987.

Actual behavior

Two failure modes observed depending on token format:

1. With SecretRef string format (env:default:...): channel startup fails with "unresolved SecretRef" error
2. With object SecretRef format ({source, provider, id}): channel attempts to connect but gets 401 Unauthorized from Discord API (/users/@me/guilds and /gateway/bot), despite the token being valid (confirmed via curl against the same endpoints)

Workaround: setting the token as a plaintext string in openclaw.json works correctly.

OpenClaw version

2026.5.3

Operating system

Linux - Debian (systemd user service)

Install method

npm (global install via npm install -g openclaw)

Model

Model

Provider / routing chain

Not applicable

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Gateway logs at startup:

[discord] channel startup failed: channels.discord.accounts.mybot.token:
unresolved SecretRef "env:default:DISCORD_TOKEN_MYBOT".
Resolve this command against an active gateway runtime snapshot before reading it.

With object SecretRef format:

[discord] channel resolve failed; using config entries. Discord API /users/@me/guilds failed (401): 401: Unauthorized
[discord] channel exited: Failed to get gateway information from Discord: Discord API /gateway/bot failed (401): 401: Unauthorized

Token validity confirmed via curl:
curl -H "Authorization: Bot <token>" https://discord.com/api/v10/users/@me → 200 OK
curl -H "Authorization: Bot <token>" https://discord.com/api/v10/gateway/bot → 200 OK
curl -H "Authorization: Bot <token>" https://discord.com/api/v10/users/@me/guilds → 200 OK (returns guild list)

openclaw secrets audit --check shows unresolved=1 for the named account token when gateway is running.
Plaintext token in openclaw.json resolves the issue immediately.

Impact and severity

Any user running OpenClaw with a named Discord account (not default) using SecretRef token resolution is affected. The issue occurs every time the gateway starts — it is 100% reproducible. Severity blocks workflow entirely as the Discord channel fails to connect and the bot appears offline. The only workaround is storing the token as plaintext in openclaw.json, which defeats the purpose of secrets management.

Additional information

No response