openclaw - 💡(How to fix) Fix [Feature]: openclaw auth migrate — atomic auth profile switch across all agent stores [1 participants]

Problem

When switching a provider's auth mode (e.g., Anthropic OAuth token → API key), each agent has its own auth-profiles.json under ~/.openclaw/agents/<id>/agent/auth-profiles.json. There is no CLI command to update all agent stores atomically. The result: partial migrations where some agents are updated and others are not, leading to silent failures where one agent is running on a broken/expired profile while others are fine.

Concrete case

We migrated the proving-ground agent from an Anthropic CC OAuth token to an API key successfully. The main agent on the same host still had both OAuth token profiles in its auth-profiles.json with lastGood.anthropic pointing to one of them. This was only discovered during a separate diagnostic pass — the gateway gave no warning that two agents on the same host were using different (and one broken) auth profiles for the same provider.

Proposed CLI command

openclaw auth migrate --provider anthropic --from <profile-id> --to <profile-id>

Or more simply, for the common "switch all agents to this profile" case:

openclaw auth set-active --provider anthropic --profile <profile-id>

This would:

1. Find all agent-scoped auth-profiles.json files on the host
2. Update lastGood.<provider> in each to point to the specified profile
3. Optionally remove deprecated profiles (with --remove-stale flag)
4. Report which agent stores were updated

Why this matters

Auth profile management is currently a per-agent manual operation that requires knowing the internal file structure. As constellations grow (multiple agents per host), the risk of partial/inconsistent migrations increases. A single atomic command would eliminate the class of "works for one agent, broken for another" failures entirely.