openclaw - 💡(How to fix) Fix Bug: x-openclaw-session-key header bypasses agent routing on /v1/chat/completions [1 comments, 2 participants]

Summary

When x-openclaw-session-key is sent as an HTTP request header on the /v1/chat/completions endpoint, agent routing via the model: "openclaw/<agentId>" field is silently ignored. The request is handled by the default (main) agent regardless of the model field. Removing the header and using sessionKey in the request body instead routes correctly.

Version

openclaw 2026.4.26

Steps to Reproduce

Fails (routes to main/default agent despite model field):

curl http://<gateway>/v1/chat/completions \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -H 'x-openclaw-session-key: my-session-key' \
  -d '{
    "model": "openclaw/cathy",
    "sessionKey": "my-session-key",
    "messages": [{"role": "user", "content": "Who are you?"}]
  }'

Works (routes to correct agent):

curl http://<gateway>/v1/chat/completions \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "openclaw/cathy",
    "sessionKey": "my-session-key",
    "messages": [{"role": "user", "content": "Who are you?"}]
  }'

Expected Behavior

The x-openclaw-session-key header should respect the model: "openclaw/<agentId>" routing. If the header is used to convey the session key, it should not override agent selection — the model field should still determine which agent handles the request.

Actual Behavior

Response model field correctly echoes back openclaw/cathy, but the assistant content comes from the default (main) agent. The session is created under the main agent's session store, not the target agent's.

Additional Context

• sessionKey in the request body alone routes correctly to the target agent
• The agentId body field is also ignored by this endpoint (only model: "openclaw/<agentId>" works for routing)
• This was discovered while debugging external API calls (Firebase Cloud Functions) that were sending the session key as both a header and a body field
• Session resurrection: once a session key is incorrectly assigned to the main agent, subsequent requests with that session key continue routing to main even if the header is removed — stale sessions need to be manually cleared from the main agent's sessions.json

Workaround

Remove the x-openclaw-session-key header. Provide the session key only via the sessionKey field in the request body.