openclaw - 💡(How to fix) Fix Model fallback does not trigger on auth/credential errors (ExpiredTokenException) [2 comments, 2 participants]

Description

When the primary model provider (e.g. amazon-bedrock) returns an authentication error like ExpiredTokenException: The security token included in the request is expired, OpenClaw does not attempt to use the configured fallback model.

Expected behavior

OpenClaw should fall back to the next configured model (e.g. ollama/gemma4) when the primary provider returns auth errors (401, 403, expired tokens, etc.), just like it would for rate limits or network errors.

Actual behavior

The agent run fails immediately with the auth error. No fallback is attempted. The error repeats on every subsequent request (heartbeats, cron jobs, user messages) until credentials are manually refreshed.

Reproduction

1. Configure amazon-bedrock as primary model with temporary session tokens
2. Configure ollama/gemma4 as fallback via openclaw models fallbacks add ollama/gemma4
3. Let the AWS session token expire
4. Send a message — OpenClaw returns ExpiredTokenException without trying fallback

Logs

2026-04-21T11:35:36.608+00:00 [agent/embedded] embedded run agent end: isError=true model=us.anthropic.claude-opus-4-6-v1 provider=amazon-bedrock error=ExpiredTokenException: The security token included in the request is expired
2026-04-21T11:49:12.205+00:00 [agent/embedded] embedded run agent end: isError=true model=us.anthropic.claude-opus-4-6-v1 provider=amazon-bedrock error=ExpiredTokenException: The security token included in the request is expired
2026-04-21T12:00:03.476+00:00 [agent/embedded] embedded run agent end: isError=true model=us.anthropic.claude-opus-4-6-v1 provider=amazon-bedrock error=ExpiredTokenException: The security token included in the request is expired

Environment

• OpenClaw: 2026.4.15
• Primary: amazon-bedrock/us.anthropic.claude-opus-4-6-v1
• Fallback: ollama/gemma4
• OS: Debian 13 (Proxmox LXC)
• Node: 24.14.1