Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix claude-cli OAuth token not auto-refreshed; agents silently fall back [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#63130•Fetched 2026-04-09 07:58:04
View on GitHub
Comments
0
Participants
1
Timeline
2
Reactions
0
Author
frankeknfrankekn
Participants
frankeknfrankekn
Timeline (top)
closed ×1labeled ×1

The anthropic:claude-cli auth profile stores an OAuth token with ~8 hour expiry and a refresh token, but OpenClaw never auto-refreshes it. When the token expires, agents silently fall back to the next provider in the fallback chain without logging any auth-specific error.

Error Message

The anthropic:claude-cli auth profile stores an OAuth token with ~8 hour expiry and a refresh token, but OpenClaw never auto-refreshes it. When the token expires, agents silently fall back to the next provider in the fallback chain without logging any auth-specific error. 4. Agent silently falls back to fireworks/kimi — no candidate_failed or auth error logged

Root Cause

The anthropic:claude-cli auth profile stores an OAuth token with ~8 hour expiry and a refresh token, but OpenClaw never auto-refreshes it. When the token expires, agents silently fall back to the next provider in the fallback chain without logging any auth-specific error.

Code Example

{
  "anthropic:claude-cli": {
    "type": "oauth",
    "provider": "claude-cli",
    "access": "sk-ant-oat01-...",
    "refresh": "sk-ant-ort01-...",
    "expires": 1775645301502
  }
}
RAW_BUFFERClick to expand / collapse

Summary

The anthropic:claude-cli auth profile stores an OAuth token with ~8 hour expiry and a refresh token, but OpenClaw never auto-refreshes it. When the token expires, agents silently fall back to the next provider in the fallback chain without logging any auth-specific error.

Observed Behavior

  1. Run openclaw models auth login --provider anthropic --method cli --set-default
  2. Token works for ~8 hours
  3. After expiry, cli exec attempts fail with No credentials found for profile "anthropic:claude-cli"
  4. Agent silently falls back to fireworks/kimi — no candidate_failed or auth error logged
  5. /status shows the fallback model, user has no indication the primary failed

Expected Behavior

  • OpenClaw should auto-refresh the OAuth token using the stored refresh token before it expires
  • If refresh fails, log a clear warning (not silent fallback)
  • Ideally refresh proactively (e.g. at 80% of token lifetime) rather than waiting for expiry

Auth Profile Structure

{
  "anthropic:claude-cli": {
    "type": "oauth",
    "provider": "claude-cli",
    "access": "sk-ant-oat01-...",
    "refresh": "sk-ant-ort01-...",
    "expires": 1775645301502
  }
}

The refresh token is present but never used by the gateway.

Additional Context

  • Multi-agent setups are affected: each agent has its own copy of the auth profile, and there is no built-in mechanism to propagate refreshed tokens across agents.
  • The claude CLI binary itself handles its own OAuth refresh via ~/.claude/.credentials.json, but OpenClaw's auth-profile layer does not leverage this.
  • The silent fallback makes debugging difficult — the only way to notice is checking /status and seeing a different model than configured.

Environment

  • OpenClaw 2026.4.8
  • Provider: claude-cli
  • Model: claude-cli/claude-sonnet-4-6
  • Auth method: cli (OAuth)

extent analysis

TL;DR

Implementing an auto-refresh mechanism for the OAuth token using the stored refresh token is likely to resolve the issue of silent fallback to the next provider in the fallback chain after token expiry.

Guidance

  • Investigate the OpenClaw authentication layer to determine why the refresh token is not being used to auto-refresh the OAuth token before it expires.
  • Consider implementing a proactive refresh mechanism that refreshes the token at a percentage of its lifetime (e.g., 80%) to prevent expiry.
  • Review the auth profile structure to ensure that the refresh token is properly stored and accessible for use in the auto-refresh process.
  • Develop a logging mechanism to provide clear warnings if the refresh process fails, rather than silently falling back to the next provider.

Example

No explicit code example is provided due to the lack of specific implementation details in the issue.

Notes

The solution may require modifications to the OpenClaw authentication layer and potentially the auth profile structure. Additionally, the multi-agent setup may require a mechanism to propagate refreshed tokens across agents.

Recommendation

Apply a workaround by implementing an auto-refresh mechanism for the OAuth token using the stored refresh token, as this is likely to resolve the issue of silent fallback to the next provider in the fallback chain after token expiry. This approach addresses the root cause of the problem and provides a clear warning if the refresh process fails.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#inference speed#output truncation#response parsing#generation error#agent setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING