Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Feature]: support SecretRef for env.vars [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#72390•Fetched 2026-04-27 05:30:35
View on GitHub
Comments
0
Participants
1
Timeline
2
Reactions
0
Author
edlevin6612edlevin6612
Participants
edlevin6612edlevin6612
Timeline (top)
cross-referenced ×1labeled ×1

Include SecretRef support for openclaw.json env block to allow a workflow where secrets stored as environment variables can be resolved at runtime (e.g. from 1Password)

Root Cause

Include SecretRef support for openclaw.json env block to allow a workflow where secrets stored as environment variables can be resolved at runtime (e.g. from 1Password)

PR fix notes

PR #43643: feat(secrets): add AWS Secrets Manager provider

Description (problem / solution / changelog)

Summary

Adds AwsSecretProvider for resolving secrets from AWS Secrets Manager.

The AWS SDK (@aws-sdk/client-secrets-manager) is lazy-loaded as an optional peer dependency — no startup cost unless the provider is configured.

Authentication

Standard AWS credential chain: env vars → shared credentials file → IAM role → EC2 instance profile.

Features

  • Version pinning: ${aws:my-secret#AWSCURRENT}
  • Profile selection and role ARN assumption
  • External ID for cross-account access
  • Configurable TTL caching (default 5 min)

Config

{
  "secrets": {
    "providers": {
      "aws": {
        "region": "us-east-1",
        "profile": "prod",
        "roleArn": "arn:aws:iam::123456789:role/openclaw"
      }
    }
  }
}

Usage: ${aws:my-secret-name}

Notes

Split from #24272 per @vincentkoc's request.

Changed files

  • src/config/aws-secret-provider.test.ts (added, +330/-0)
  • src/config/aws-secret-provider.ts (added, +305/-0)

Code Example

"secrets": {
    "providers": {
      "default": { "source": "env" },
      "op-my-sectet": {
        "source": "exec",
        "command": "/usr/bin/op",
        "allowInsecurePath": true,
        "args": ["read", "--no-newline", "op://MyVault/MySecret/credential"],
        "passEnv": ["HOME", "OP_SERVICE_ACCOUNT_TOKEN"],
        "jsonOnly": false
      },
  "env": {
    "vars": {
      "MY_SECRET_VAR": { "source": "exec", "provider": "op-my-secret", "id": "value" }
    }
RAW_BUFFERClick to expand / collapse

Summary

Include SecretRef support for openclaw.json env block to allow a workflow where secrets stored as environment variables can be resolved at runtime (e.g. from 1Password)

Problem to solve

Currently, secretRef is not supported for the env block in openclaw.json. This makes setting/passing environment variables where the value is not static but rather derived dynamically (e.g. from 1Password) difficult.

Proposed solution

Extend SectrerRef support for the env block, similar to API keys:

  "secrets": {
    "providers": {
      "default": { "source": "env" },
      "op-my-sectet": {
        "source": "exec",
        "command": "/usr/bin/op",
        "allowInsecurePath": true,
        "args": ["read", "--no-newline", "op://MyVault/MySecret/credential"],
        "passEnv": ["HOME", "OP_SERVICE_ACCOUNT_TOKEN"],
        "jsonOnly": false
      },
  "env": {
    "vars": {
      "MY_SECRET_VAR": { "source": "exec", "provider": "op-my-secret", "id": "value" }
    }

Alternatives considered

Alternative is to define environment variables in .env as static values but that is counterproductive to having all secrets stored in an external values like 1Password. One can then have Gateway and Model tokens/passwords in 1Password but then still have to keep other secrets (e.g. ones used by Skills requiring environment vars) on the filesystem.

Impact

Someone wishing to offload all secret storage to an external secret management system for a better security posture.

Example: https://prokopov.me/posts/securing-openclaw-with-1password/

Evidence/examples

No response

Additional information

No response

extent analysis

TL;DR

Extend SecretRef support to the env block in openclaw.json to allow dynamic resolution of secrets stored as environment variables.

Guidance

  • Review the proposed solution and consider extending SecretRef support for the env block, similar to API keys, to enable dynamic secret resolution.
  • Evaluate the use of external secret management systems like 1Password to store sensitive information and improve security posture.
  • Assess the feasibility of defining environment variables in .env as static values versus using dynamic secrets resolution.
  • Consider the example use case provided, where Gateway and Model tokens/passwords are stored in 1Password, and other secrets are used by Skills requiring environment variables.

Example

"env": {
  "vars": {
    "MY_SECRET_VAR": { "source": "exec", "provider": "op-my-secret", "id": "value" }
  }
}

Notes

The proposed solution aims to improve security by allowing dynamic resolution of secrets stored as environment variables. However, the implementation details and potential limitations are not fully explored in the issue.

Recommendation

Apply the proposed workaround by extending SecretRef support to the env block, as it allows for more flexible and secure secret management.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#response parsing#generation error#database connection#environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Feature]: support SecretRef for env.vars [1 pull requests, 1 participants]