Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: imageModel with Anthropic API key (SecretRef) fails with 401 - auth not passed correctly [1 pull requests, 1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#69620•Fetched 2026-04-22 07:50:09
View on GitHub
Comments
1
Participants
1
Timeline
4
Reactions
0
Author
MP225MP225
Participants
MP225MP225
Timeline (top)
labeled ×2commented ×1cross-referenced ×1

imageModel configured with anthropic/claude-haiku-4-5 always returns 401 invalid x-api-key, even though the same API key works correctly via direct curl and is correctly resolved by models status.

Error Message

[tools] image failed: Image model failed (anthropic/claude-haiku-4-5): 401 {"type":"error","error":{"type":"authentication_error","message":"invalid x-api-key"}} 401 {"type":"error","error":{"type":"authentication_error","message":"invalid x-api-key"},"request_id":"req_011CaFVecczM8PV5ABFrp2az"}

Root Cause

Primary model: ollama/glm-5:cloud (no vision capability) Fallbacks: ollama/kimi-k2:1t-cloud, anthropic/claude-haiku-4-5 imageModel needed because primary model cannot process images. imageModel configured in agents.defaults.imageModel.primary: anthropic/claude-haiku-4-5 Auth via SecretRef: auth-profiles.json keyRef points to env:ANTHROPIC_API_KEY. models status confirms key resolved: anthropic:default=ref(env:ANTHROPIC_API_KEY) | env=sk-ant-a... models auth order set to anthropic:default for provider anthropic. No profile field supported in imageModel config (schema rejects it).

Fix Action

Fix / Workaround

imageModel configured with anthropic/claude-haiku-4-5 always returns 401 invalid x-api-key, even though the same API key works correctly via direct curl and is correctly resolved by models status.

PR fix notes

PR #69682: fix(agents): resolve auth profile for imageModel inference calls (#69620)

Description (problem / solution / changelog)

Summary

  • seed the image-model runtime auth before media model discovery so SecretRef-backed Anthropic credentials reach the discovered client path
  • keep the existing model-specific auth resolution after discovery, and add a regression test that locks the auth-before-discovery ordering

Root Cause

The image understanding path discovered PI models before seeding runtime auth, so SecretRef-backed credentials were missing when the image-model client was constructed.

Changes

  • src/media-understanding/image.ts: resolve provider auth and set the runtime API key before model discovery
  • src/media-understanding/image.test.ts: add a regression test for SecretRef-backed image auth ordering

Test

  • pnpm test src/media-understanding/image.test.ts

Closes #69620

Changed files

  • src/media-understanding/image.test.ts (modified, +47/-0)
  • src/media-understanding/image.ts (modified, +10/-1)

Code Example

[tools] image failed: Image model failed (anthropic/claude-haiku-4-5): 
401 {"type":"error","error":{"type":"authentication_error","message":"invalid x-api-key"},"request_id":"req_011CaFVecczM8PV5ABFrp2az"}
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

imageModel configured with anthropic/claude-haiku-4-5 always returns 401 invalid x-api-key, even though the same API key works correctly via direct curl and is correctly resolved by models status.

Steps to reproduce

  1. Configure ANTHROPIC_API_KEY in ~/.openclaw/.env
  2. Set auth-profiles.json with keyRef pointing to env:ANTHROPIC_API_KEY
  3. Set agents.defaults.imageModel.primary to anthropic/claude-haiku-4-5
  4. Send an image to the agent via Signal
  5. Observe 401 authentication_error in gateway logs

Expected behavior

imageModel uses the same auth profile as configured for the anthropic provider and processes the image successfully.

Actual behavior

[tools] image failed: Image model failed (anthropic/claude-haiku-4-5): 401 {"type":"error","error":{"type":"authentication_error","message":"invalid x-api-key"}}

OpenClaw version

2026.4.15 (041266a)

Operating system

Ubuntu 24.04

Install method

npm global

Model

anthropic/claude-haiku-4-5

Provider / routing chain

openclaw → anthropic

Additional provider/model setup details

Primary model: ollama/glm-5:cloud (no vision capability) Fallbacks: ollama/kimi-k2:1t-cloud, anthropic/claude-haiku-4-5 imageModel needed because primary model cannot process images. imageModel configured in agents.defaults.imageModel.primary: anthropic/claude-haiku-4-5 Auth via SecretRef: auth-profiles.json keyRef points to env:ANTHROPIC_API_KEY. models status confirms key resolved: anthropic:default=ref(env:ANTHROPIC_API_KEY) | env=sk-ant-a... models auth order set to anthropic:default for provider anthropic. No profile field supported in imageModel config (schema rejects it).

Logs, screenshots, and evidence

[tools] image failed: Image model failed (anthropic/claude-haiku-4-5): 
401 {"type":"error","error":{"type":"authentication_error","message":"invalid x-api-key"},"request_id":"req_011CaFVecczM8PV5ABFrp2az"}

Impact and severity

Affected: All users using API key auth (SecretRef) with imageModel Severity: Blocks all image processing via imageModel Frequency: Always (100% reproducible) Consequence: imageModel completely non-functional for API key users

Additional information

Direct curl with same key succeeds (HTTP 200). openclaw models status shows key correctly resolved: anthropic:default=ref(env:ANTHROPIC_API_KEY) The imageModel appears to not inherit the auth profile from the anthropic provider configuration. setup-token flow not applicable as it expects sk-ant-oat01- format, not sk-ant-api03- API keys.

extent analysis

TL;DR

The imageModel may not be inheriting the auth profile from the anthropic provider configuration, causing the 401 invalid x-api-key error.

Guidance

  • Verify that the auth-profiles.json file is correctly formatted and that the keyRef points to the correct environment variable ANTHROPIC_API_KEY.
  • Check the models status output to ensure that the key is correctly resolved for the anthropic provider.
  • Consider adding a profile field to the imageModel configuration, if possible, to explicitly specify the auth profile to use.
  • Test the imageModel with a different auth method, such as setup-token flow, if applicable.

Example

No code snippet is provided as the issue seems to be related to configuration and authentication.

Notes

The issue may be related to the fact that the imageModel does not inherit the auth profile from the anthropic provider configuration. The models status output shows that the key is correctly resolved, but the imageModel still returns a 401 error.

Recommendation

Apply workaround: Modify the imageModel configuration to explicitly specify the auth profile, if possible, or try a different auth method. The reason is that the current configuration seems to not be working as expected, and a workaround may be necessary to resolve the issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

imageModel uses the same auth profile as configured for the anthropic provider and processes the image successfully.

#api#cache error#pipeline error#runtime error#dependency conflict

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING