openclaw - 💡(How to fix) Fix [Bug] post-compaction embedding sync fails with 500 when memorySearch.remote.baseUrl points to non-OpenAI host

title: "post-compaction embedding sync fallback to OpenAI API despite memorySearch.remote.baseUrl set" labels: [bug]

Description

When memorySearch.remote.baseUrl is configured to a self-hosted embedding endpoint (e.g. http://192.168.1.18:5050/v1/) and memorySearch.remote.apiKey is NOT set, the post-compaction memory sync fails with:

memory sync skipped (post-compaction): openai embeddings failed: 500

Expected Behavior

All embedding calls (including post-compaction sync) should route to the configured memorySearch.remote.baseUrl.

Actual Behavior

Embedding calls appear to fallback to https://api.openai.com/v1, which returns 500 since the user has no OpenAI subscription.

Configuration

"memorySearch": {
  "provider": "openai",
  "remote": {
    "baseUrl": "http://192.168.1.18:5050/v1/"
  },
  "model": "Qwen3-Embedding-0.6B",
  "sources": ["memory", "sessions"]
}

remote.apiKey is not set. The self-hosted embedding API does not require authentication.

Evidence

1. Self-hosted embedding API works correctly:

   curl -X POST http://192.168.1.18:5050/v1/embeddings \
     -H "Content-Type: application/json" \
     -d "{\"model\":\"Qwen3-Embedding-0.6B\",\"input\":[\"hello\"]}"

   Returns valid embedding vectors ✅

2. Works with Authorization: Bearer (empty token) ✅

3. Works with no auth header ✅

Root Cause Analysis (Source Code Review)

In resolveRemoteEmbeddingBearerClient (dist/memory-core-host-engine-embeddings-*.js):

const remoteApiKey = resolveMemorySecretInputString({
    value: remote?.apiKey,
    path: "..."
});
const apiKey = remoteApiKey ? remoteApiKey : requireApiKey(
    await resolveApiKeyForProvider({...}),
    params.provider
);

When remote?.apiKey is unset, resolveApiKeyForProvider falls back to the provider config. If a provider has a baseUrl configured (e.g. providers.openai.baseUrl = "https://api.openai.com/v1"), the request routes there instead of remote.baseUrl.

Suggested Fixes

• Option A: When remote.baseUrl is set but remote.apiKey is not, allow request without Authorization header (skip auth fallback)
• Option B: Support a sentinel value like "__none__" for remote.apiKey to explicitly disable auth
• Option C: Document that remote.apiKey is required when remote.baseUrl differs from the default OpenAI endpoint

Environment

• OpenClaw version: v2026.5.12
• OS: macOS
• Embedding model: Qwen3-Embedding-0.6B on Ubuntu (port 5050)