Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug](gateway): LLM calls continue after API key is unbound — no user-visible stop signal

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

I unbound my API key in OpenClaw last night, closed the chat window, and went to sleep.

Woke up to OpenRouter showing ~$168 in new spend overnight. OpenClaw gateway had been silently calling gpt-5.5 the entire time, from a session I assumed was dead.

There's no documented user-facing way to detect or stop this.

Root Cause

@mapick/cost-firewall plugin (author: same as reporter) surfaced the issue via its local event log showing model_call_ended events during sleep period. The plugin provides a mitigation (emergency stop + cost tracking) but the root cause is in the gateway: active sessions are not terminated when credentials are removed.

Fix Action

Fix / Workaround

@mapick/cost-firewall plugin (author: same as reporter) surfaced the issue via its local event log showing model_call_ended events during sleep period. The plugin provides a mitigation (emergency stop + cost tracking) but the root cause is in the gateway: active sessions are not terminated when credentials are removed.

If maintainers want, I can either:

  • (a) open a PR adding cost-firewall as a recognized OpenClaw plugin, or
  • (b) extract a smaller "list + stop in-flight sessions" patch into core.
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

I unbound my API key in OpenClaw last night, closed the chat window, and went to sleep.

Woke up to OpenRouter showing ~$168 in new spend overnight. OpenClaw gateway had been silently calling gpt-5.5 the entire time, from a session I assumed was dead.

There's no documented user-facing way to detect or stop this.

Steps to reproduce

  1. Unbind the API key in OpenClaw (Settings → Models → Provider → Remove key).
  2. Close the OpenClaw chat window. Do not manually kill the gateway process.
  3. Wait a few hours.
  4. Check OpenRouter usage — new completion calls still appear.

In my case, session 927dd50b-33a1-48c2-a303-5fa72ec946b5 continued calling gpt-5.5 at ~63.5K input tokens per call. No cron, no scheduled skills.

Expected behavior

When the user unbinds the key or closes the chat, in-flight + scheduled LLM calls should:

  • (a) stop gracefully, or
  • (b) produce a visible warning, or
  • (c) at minimum be auditable from a built-in command.

Currently none of (a)/(b)/(c) is available.

Actual behavior

Session 927dd50b... continued calling gpt-5.5 at ~63.5K tokens per call for hours after key unbinding. No warning, no CLI command to detect or stop the rogue session.

OpenClaw version

2026.5.4

Operating system

macOS 26.3.1

Install method

npm global

Model

gpt-5.5

Provider / routing chain

OpenRouter

Additional provider/model setup details

OpenRouter usage showing calls AFTER the key was unbound: <img width="1130" height="678" alt="Image" src="https://github.com/user-attachments/assets/ffdf786c-5825-4e1a-865d-1e735cd3f08d" />

The repeating session that kept calling: <img width="1440" height="1440" alt="Image" src="https://github.com/user-attachments/assets/0151b549-fb6b-459a-af06-2af1518ee3f0" />

Logs, screenshots, and evidence

Impact and severity

  • Affected: All OpenClaw users who unbind API keys expecting calls to stop
  • Severity: Medium-High — silent money burn
  • Frequency: Reproducible on clean install
  • Consequence: Users lose money with no warning; trust in key unbinding is broken

Additional information

@mapick/cost-firewall plugin (author: same as reporter) surfaced the issue via its local event log showing model_call_ended events during sleep period. The plugin provides a mitigation (emergency stop + cost tracking) but the root cause is in the gateway: active sessions are not terminated when credentials are removed.

If maintainers want, I can either:

  • (a) open a PR adding cost-firewall as a recognized OpenClaw plugin, or
  • (b) extract a smaller "list + stop in-flight sessions" patch into core.

Last known good: N/A (behavior present in multiple versions). First known bad: 2026.5.4.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

When the user unbinds the key or closes the chat, in-flight + scheduled LLM calls should:

  • (a) stop gracefully, or
  • (b) produce a visible warning, or
  • (c) at minimum be auditable from a built-in command.

Currently none of (a)/(b)/(c) is available.

#api#vector store#embedding generation#cache error#pipeline error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING