openclaw - 💡(How to fix) Fix BUG: Gateway startup aborts on stale SecretRef in non-default auth profile [1 comments, 2 participants]

Bug type

Crash (process/app exits or hangs)

Beta release blocker

No

Summary

In OpenClaw 2026.4.29, gateway startup can abort if a generated model auth profile contains a stale SecretRef provider reference, even when that provider/model is not the default routing path. A single unresolved auth-profile SecretRef caused the gateway service to repeatedly fail startup instead of degrading only the affected provider/profile.

Steps to reproduce

1. Configure a model auth profile with an API-key SecretRef provider.
2. Rename or remove that SecretRef provider from the main config.
3. Leave the generated auth profile pointing at the old provider name.
4. Restart the gateway.

Expected behavior

Gateway startup should remain available and mark only the affected auth profile/provider as unavailable, or produce a targeted degraded credential warning. Unrelated models, channels, and the control UI should not be taken offline by a stale SecretRef in a non-default model auth profile.

Actual behavior

Gateway startup failed repeatedly with a required-secrets startup error because the generated auth profile still referenced a removed SecretRef provider. The default model route was unrelated and still had valid credentials, but the whole gateway service stopped until the generated auth profile was manually updated.

OpenClaw version

2026.4.29

Operating system

Ubuntu 26.04 LTS

Install method

systemd gateway service

Model

Default model route was not the failing provider; failure came from an unrelated generated auth profile.

Provider / routing chain

SecretRef-backed model auth profile in agents/*/agent/auth-profiles.json; stale provider reference after provider rename/removal.

Additional provider/model setup details

SecretRef-backed API-key auth profile. Provider names, key IDs, paths, and account details intentionally redacted.

Logs, screenshots, and evidence

Observed startup error pattern:

[secrets] [SECRETS_RELOADER_DEGRADED] SecretProviderResolutionError: Secret provider "<old-provider>" is not configured (ref: exec:<old-provider>:<key-id>).
Gateway failed to start: Error: Startup failed: required secrets are unavailable. SecretProviderResolutionError: Secret provider "<old-provider>" is not configured (ref: exec:<old-provider>:<key-id>).

After updating the generated auth profile to reference the new provider, secrets audit reported unresolved=0 and the gateway reached ready.

Impact and severity

High reliability impact: one stale SecretRef in a non-default generated model auth profile can take down the entire gateway, including the control UI and unrelated channel/runtime access.

Additional information

This may be related to startup resolving auth-profile SecretRefs as globally required credential state. The safer behavior would be fail-closed for the affected provider/profile while keeping the gateway online when the unresolved SecretRef is not required for the selected/default model route.