Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix doctor false positive warning on Gateway auth token handled in secrets [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#65201•Fetched 2026-04-12 13:25:07
View on GitHub
Comments
0
Participants
1
Timeline
4
Reactions
0
Author
sebdef123sebdef123
Participants
sebdef123sebdef123
Timeline (top)
labeled ×2cross-referenced ×1referenced ×1

I have this message on doctor. It looks like a false positive

◇ Gateway auth ─────────────────────────────────────────────────────────╮ │ │ │ Gateway token is managed via SecretRef and is currently unavailable. │ │ Doctor will not overwrite gateway.auth.token with a plaintext value. │ │ Resolve/rotate the external secret source, then rerun doctor. │ │ │

openclaw secrets audit shows unresolved=0 openclaw secrets reload succeeds the gateway is actually using the SecretRef fine

Useful bits to include:

openclaw --version : OpenClaw 2026.4.11 (769908e) openclaw secrets audit : nothing about gateway.auth.token the gateway.auth.token SecretRef shape --> { "channels": { "discord": { "token": "xxx" }, "telegram": { "botToken": "xxx" } }, "gateway": { "auth": { "token": "xxxxx" } } }

Root Cause

I have this message on doctor. It looks like a false positive

◇ Gateway auth ─────────────────────────────────────────────────────────╮ │ │ │ Gateway token is managed via SecretRef and is currently unavailable. │ │ Doctor will not overwrite gateway.auth.token with a plaintext value. │ │ Resolve/rotate the external secret source, then rerun doctor. │ │ │

openclaw secrets audit shows unresolved=0 openclaw secrets reload succeeds the gateway is actually using the SecretRef fine

Useful bits to include:

openclaw --version : OpenClaw 2026.4.11 (769908e) openclaw secrets audit : nothing about gateway.auth.token the gateway.auth.token SecretRef shape --> { "channels": { "discord": { "token": "xxx" }, "telegram": { "botToken": "xxx" } }, "gateway": { "auth": { "token": "xxxxx" } } }

Fix Action

Fixed

PR fix notes

PR #65229: fix(doctor): resolve env-backed SecretRef in gateway auth health check to prevent false-positive warning

Description (problem / solution / changelog)

Problem

When gateway.auth.token is configured as a SecretRef backed by an environment variable (e.g. via openclaw secrets or a credentials file), running openclaw doctor shows a false-positive warning:

◇ Gateway auth ───────────────────────────────────────────────────────────╮
│                                                                         │
│  Gateway token is managed via SecretRef and is currently unavailable.  │
│  Doctor will not overwrite gateway.auth.token with a plaintext value.  │
│  Resolve/rotate the external secret source, then rerun doctor.         │
│                                                                         │

This happens even when:

  • openclaw secrets audit shows unresolved=0
  • openclaw secrets reload succeeds
  • The gateway itself is authenticating fine via the SecretRef

Root cause

runGatewayAuthHealth calls resolveGatewayAuth without passing env, so env-backed SecretRef tokens are never resolved. auth.token comes back undefined → needsToken = true → the warning fires even though the token is actually available at runtime.

Fix

Pass env: process.env to resolveGatewayAuth (one line change). This mirrors how the token is resolved at gateway startup, so if the secret is available at doctor time it resolves correctly and needsToken becomes false.

Fixes #65201

Changed files

  • src/flows/doctor-health-contributions.ts (modified, +1/-0)
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

I have this message on doctor. It looks like a false positive

◇ Gateway auth ─────────────────────────────────────────────────────────╮ │ │ │ Gateway token is managed via SecretRef and is currently unavailable. │ │ Doctor will not overwrite gateway.auth.token with a plaintext value. │ │ Resolve/rotate the external secret source, then rerun doctor. │ │ │

openclaw secrets audit shows unresolved=0 openclaw secrets reload succeeds the gateway is actually using the SecretRef fine

Useful bits to include:

openclaw --version : OpenClaw 2026.4.11 (769908e) openclaw secrets audit : nothing about gateway.auth.token the gateway.auth.token SecretRef shape --> { "channels": { "discord": { "token": "xxx" }, "telegram": { "botToken": "xxx" } }, "gateway": { "auth": { "token": "xxxxx" } } }

Steps to reproduce

  1. set gateway auth token in credentials
  2. restart gateway
  3. run doctor

Expected behavior

no warning in doctor

Actual behavior

warning : ◇ Gateway auth ─────────────────────────────────────────────────────────╮ │ │ │ Gateway token is managed via SecretRef and is currently unavailable. │ │ Doctor will not overwrite gateway.auth.token with a plaintext value. │ │ Resolve/rotate the external secret source, then rerun doctor. │ │ │

OpenClaw version

2026.4.11

Operating system

macOS

Install method

npm global

Model

GPT 4.5

Provider / routing chain

openclaw -> Mac mini -> OpenAI API

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

extent analysis

TL;DR

The warning about the Gateway token being unavailable may be a false positive, and rerunning the openclaw secrets reload command or checking the SecretRef configuration could resolve the issue.

Guidance

  • Verify that the SecretRef is correctly configured and the gateway.auth.token is properly set in the credentials.
  • Check the output of openclaw secrets audit to ensure there are no issues with the secret source.
  • Rerun openclaw secrets reload to ensure the secrets are up-to-date.
  • If the issue persists, try restarting the gateway and then rerunning the doctor command.

Example

No code snippet is provided as it is not clearly supported by the issue.

Notes

The issue may be specific to the OpenClaw version (2026.4.11) or the macOS operating system. Further investigation is needed to determine the root cause of the false positive warning.

Recommendation

Apply workaround: Rerun openclaw secrets reload and check the SecretRef configuration to resolve the potential false positive warning. This is because the openclaw secrets audit shows no issues and the gateway is using the SecretRef fine, indicating that the warning may be incorrect.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

no warning in doctor

#api#integration issue#index setup#retrieval issue#search optimization

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING