openclaw - 💡(How to fix) Fix [Bug]: xAI OAuth: refresh token stored but not used for auto-renewal (manual re-auth required every ~6h)

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

OpenClaw stores the xAI OAuth refresh token correctly in auth-profiles.json, but does not use it to automatically renew the access token when it expires. This forces a manual full OAuth flow (requiring a browser + SSH tunnel) every ~6 hours.

Steps to reproduce

1. On a remote/headless Linux VPS, run: openclaw models auth login --provider xai --method oauth
2. Complete the browser OAuth flow via SSH tunnel (127.0.0.1:56121)
3. Confirm auth profile saved: openclaw models auth list → shows xai:[email protected] with expiry ~6h from now
4. Verify refresh token is stored: cat ~/.openclaw/agents/main/agent/auth-profiles.json | grep -A8 "xai:" → both "access" and "refresh" fields present
5. Wait for access token to expire (~6h), or check after expiry
6. Observe: OpenClaw does not silently renew — next request to xAI/grok fails or doctor reports "expiring (Xh)" without triggering auto-refresh

Expected behavior

When the access token nears expiry, OpenClaw should use the stored refresh token to obtain a new access token silently — without browser interaction. xAI explicitly recommends using the refresh token instead of repeating the full OAuth flow.

Actual behavior

Full OAuth flow completes. auth-profiles.json is written with both access and refresh fields. Access token expires after ~6 hours. OpenClaw does not use the stored refresh token to renew silently. Manual full OAuth flow (browser + SSH tunnel) required every ~6h.

OpenClaw version

2026.5.22 (a374c3a)

Operating system

Ubuntu 24.04 - Linux VPS (remote/headless)

Install method

nom global

Model

xai/grok-4.3 (via xAI OAuth — SuperGrok subscription)

Provider / routing chain

xai / xAI Grok OAuth (SuperGrok subscription)

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

On remote/headless VPS deployments, the full OAuth flow requires an SSH tunnel from a local machine. Every ~6 hours is a significant operational burden. Other providers in OpenClaw (Google Meet, Chutes) appear to support auto-refresh already — likely just needs to be wired up for xAI.

Additional information

No response