Summary

When running openclaw onboard with multiple agents configured in openclaw.json, the auth token (or tokenRef) is only written to ~/.openclaw/agents/main/agent/auth-profiles.json. It is not distributed to the other configured agents (e.g., agents/chief/, agents/developer/, agents/qa/, etc.).

This causes non-default agents to fall back to free/fallback models silently, since they have no auth credentials for the primary model provider.

Steps to reproduce

1. Configure 7 agents in openclaw.json:

{
  "agents": {
    "list": [
      { "id": "chief", "default": true, "model": "anthropic/claude-opus-4-6" },
      { "id": "developer", "model": "anthropic/claude-sonnet-4-6" },
      { "id": "qa", "model": "anthropic/claude-opus-4-6" },
      { "id": "secretary", "model": "anthropic/claude-sonnet-4-6" },
      { "id": "lawyer", "model": "anthropic/claude-opus-4-6" },
      { "id": "writer", "model": "openrouter/z-ai/glm-4.5-air:free" },
      { "id": "experimenter", "model": "anthropic/claude-opus-4-6" }
    ]
  }
}

1. Run openclaw onboard and authenticate with Anthropic (setup-token via env var reference)

2. Check auth files:

ls ~/.openclaw/agents/*/agent/auth-profiles.json

Expected behavior

onboard should write auth-profiles.json to all agent directories listed in agents.list, not just agents/main/.

Alternatively, the gateway should resolve auth from a single canonical location (e.g., agents/main/agent/auth-profiles.json) when an agent-specific auth file is missing, so agents inherit the default auth automatically.

Actual behavior

• Only ~/.openclaw/agents/main/agent/auth-profiles.json gets the new tokenRef
• Other agents either have stale tokens (with error cooldowns) or no auth file at all
• Agents silently fall back to free fallback models (e.g., GLM 4.5 Air) without any warning to the user
• The silent fallback is particularly confusing because the user thinks agents are using Sonnet/Opus but they're actually on a much weaker free model

Workaround

Manually copy the auth-profiles.json to all agent directories:

for agent in chief developer qa secretary lawyer writer experimenter; do
  mkdir -p ~/.openclaw/agents/$agent/agent
  cp ~/.openclaw/agents/main/agent/auth-profiles.json ~/.openclaw/agents/$agent/agent/
done
openclaw gateway start  # restart to pick up new tokens

Environment

• OpenClaw version: 2026.3.8
• OS: Ubuntu Linux 22.04
• Auth method: Anthropic setup-token (env var reference)
• Agent count: 7

Related

• #28293 — Non-default agents get 401 with same token (similar symptom, different root cause)
• #38336 — OAuth renewal doesn't update provisioned copy (related auth distribution gap)