openclaw - 💡(How to fix) Fix [Bug]: OpenClaw exec subprocesses expose invalid GH_TOKEN, breaking gh even when gh auth login is valid [1 participants]

openclaw2026-03-24 13:30:48

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#53709•Fetched 2026-04-08 01:24:30

View on GitHub

Comments

Participants

Timeline

Reactions

Author

mackelito

Participants

mackelito

Timeline (top)

labeled ×2

Observed behavior

In a normal shell, gh api user works correctly.
Inside OpenClaw, gh auth status reports:
invalid token from GH_TOKEN
valid keyring login for the correct GitHub account
Any gh command in OpenClaw fails with 401 unless I explicitly clear GH_TOKEN first.

What was ruled out

bad gh auth login state
invalid GitHub account/token in keyring
gateway.cmd setting GH_TOKEN
.openclaw/.env setting GH_TOKEN
Windows user/machine env registry (HKCU:\Environment, HKLM:...Environment)
PowerShell user profiles
duplicate startup path issue
Scheduled Task XML/action setting GH_TOKEN

Important proof

Added temporary env dump to C:\Users\m.openclaw\gateway.cmd
On startup, it showed no GH_TOKEN / GITHUB_TOKEN
But inside OpenClaw exec subprocesses, GH_TOKEN is present

Conclusion
GH_TOKEN appears to be introduced during OpenClaw runtime / exec subprocess environment construction, not from the initial Windows startup environment.

Impact

breaks GitHub CLI operations inside OpenClaw
causes false “bad credentials” errors
masks a valid keyring-authenticated gh login

Workaround
Use:

  $env:GH_TOKEN=''; gh ...

Root Cause

Observed behavior

In a normal shell, gh api user works correctly.
Inside OpenClaw, gh auth status reports:
invalid token from GH_TOKEN
valid keyring login for the correct GitHub account
Any gh command in OpenClaw fails with 401 unless I explicitly clear GH_TOKEN first.

What was ruled out

bad gh auth login state
invalid GitHub account/token in keyring
gateway.cmd setting GH_TOKEN
.openclaw/.env setting GH_TOKEN
Windows user/machine env registry (HKCU:\Environment, HKLM:...Environment)
PowerShell user profiles
duplicate startup path issue
Scheduled Task XML/action setting GH_TOKEN

Important proof

Added temporary env dump to C:\Users\m.openclaw\gateway.cmd
On startup, it showed no GH_TOKEN / GITHUB_TOKEN
But inside OpenClaw exec subprocesses, GH_TOKEN is present

Conclusion
GH_TOKEN appears to be introduced during OpenClaw runtime / exec subprocess environment construction, not from the initial Windows startup environment.

Impact

breaks GitHub CLI operations inside OpenClaw
causes false “bad credentials” errors
masks a valid keyring-authenticated gh login

Workaround
Use:

  $env:GH_TOKEN=''; gh ...

Fix Action

Fix / Workaround

Workaround
Use:

Code Example

$env:GH_TOKEN=''; gh ... 

### Steps to reproduce

1. Log in with gh auth login                                                                                               
 2. Verify in normal shell:                                                                                                 
 - gh api user works                                                                                                        
 3. Run inside OpenClaw:                                                                                                    
 - gh auth status                                                                                                           
 4. Observe:                                                                                                                
 - Failed to log in to github.com using token (GH_TOKEN)                                                                    
 - valid keyring login shown separately                                                                                     
 5. Run:                                                                                                                    
 - $env:GH_TOKEN=''; gh auth status                                                                                         
 6. Observe:                                                                                                                
 - command works as expected      

### Expected behavior

should be available...

### Actual behavior

 - Added temporary env dump to C:\Users\m\.openclaw\gateway.cmd                                                         
 - On startup, it showed no GH_TOKEN / GITHUB_TOKEN                                                                         
 - But inside OpenClaw exec subprocesses, GH_TOKEN is present  

### OpenClaw version

v2026.3.23-2

### Operating system

Windows 11

### Install method

npm global

### Model

openai-codex/gpt-5.4

### Provider / routing chain

openai-codex

### Additional provider/model setup details

_No response_

### Logs, screenshots, and evidence

RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Summary

Observed behavior

In a normal shell, gh api user works correctly.
Inside OpenClaw, gh auth status reports:
invalid token from GH_TOKEN
valid keyring login for the correct GitHub account
Any gh command in OpenClaw fails with 401 unless I explicitly clear GH_TOKEN first.

What was ruled out

bad gh auth login state
invalid GitHub account/token in keyring
gateway.cmd setting GH_TOKEN
.openclaw/.env setting GH_TOKEN
Windows user/machine env registry (HKCU:\Environment, HKLM:...Environment)
PowerShell user profiles
duplicate startup path issue
Scheduled Task XML/action setting GH_TOKEN

Important proof

Added temporary env dump to C:\Users\m.openclaw\gateway.cmd
On startup, it showed no GH_TOKEN / GITHUB_TOKEN
But inside OpenClaw exec subprocesses, GH_TOKEN is present

Conclusion
GH_TOKEN appears to be introduced during OpenClaw runtime / exec subprocess environment construction, not from the initial Windows startup environment.

Impact

breaks GitHub CLI operations inside OpenClaw
causes false “bad credentials” errors
masks a valid keyring-authenticated gh login

Workaround
Use:

  $env:GH_TOKEN=''; gh ... 

### Steps to reproduce

1. Log in with gh auth login                                                                                               
2. Verify in normal shell:                                                                                                 
- gh api user works                                                                                                        
3. Run inside OpenClaw:                                                                                                    
- gh auth status                                                                                                           
4. Observe:                                                                                                                
- Failed to log in to github.com using token (GH_TOKEN)                                                                    
- valid keyring login shown separately                                                                                     
5. Run:                                                                                                                    
- $env:GH_TOKEN=''; gh auth status                                                                                         
6. Observe:                                                                                                                
- command works as expected      

### Expected behavior

should be available...

### Actual behavior

- Added temporary env dump to C:\Users\m\.openclaw\gateway.cmd                                                         
- On startup, it showed no GH_TOKEN / GITHUB_TOKEN                                                                         
- But inside OpenClaw exec subprocesses, GH_TOKEN is present  

### OpenClaw version

v2026.3.23-2

### Operating system

Windows 11

### Install method

npm global

### Model

openai-codex/gpt-5.4

### Provider / routing chain

openai-codex

### Additional provider/model setup details

_No response_

### Logs, screenshots, and evidence

```shell

Impact and severity

No response

Additional information

No response

extent analysis

Fix Plan

To resolve the issue with GH_TOKEN being introduced during OpenClaw runtime, we need to ensure that the GH_TOKEN environment variable is unset or cleared before executing gh commands inside OpenClaw. Here are the steps:

Clear GH_TOKEN environment variable: Before running any gh command, clear the GH_TOKEN environment variable using the following PowerShell command:

$env:GH_TOKEN=''

Modify OpenClaw configuration: Update the OpenClaw configuration to unset the GH_TOKEN environment variable before executing subprocesses. This can be done by adding the following line to the gateway.cmd file:

set GH_TOKEN=

Use gh command with environment variable override: Alternatively, you can use the gh command with the environment variable override option to ignore the GH_TOKEN environment variable. For example:

$env:GH_TOKEN=''; gh auth status

Verification

To verify that the fix worked, follow these steps:

Run gh auth status inside OpenClaw and verify that it reports a valid keyring login.
Run gh api user inside OpenClaw and verify that it returns the expected result.
Verify that the GH_TOKEN environment variable is not present in the OpenClaw subprocess environment.

Extra Tips

Make sure to update the OpenClaw configuration to persist the changes across restarts.
If you are using a CI/CD pipeline, ensure that the GH_TOKEN environment variable is not set in the pipeline environment.
Consider using a more secure approach to authenticate with GitHub, such as using a GitHub App or an OAuth token.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

FAQ

Expected behavior

should be available...

#api #GPU compatibility #latency issue #model loading #dependency error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

openclaw - 💡(How to fix) Fix [Bug]: OpenClaw exec subprocesses expose invalid GH_TOKEN, breaking gh even when gh auth login is valid [1 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Fix Action

Fix / Workaround

Code Example

Bug type

Summary

Impact and severity

Additional information

extent analysis

Fix Plan

Verification

Extra Tips

FAQ

Expected behavior

Still need to ship something?

TRENDING

openclaw - 💡(How to fix) Fix [Bug]: OpenClaw exec subprocesses expose invalid GH_TOKEN, breaking gh even when gh auth login is valid [1 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Fix Action

Fix / Workaround

Code Example

Bug type

Summary

Impact and severity

Additional information

extent analysis

Fix Plan

Verification

Extra Tips

FAQ

Expected behavior

Still need to ship something?

RELATED_DISCOVERY

TRENDING