openclaw - 💡(How to fix) Fix Per-agent auth profiles cause credential drift and stale duplicate OAuth profiles across agents [1 participants]

In multi-agent setups, each agent stores its own auth-profiles.json. This becomes fragile when OAuth profile naming changes across versions — for example, older openai-codex:default versus newer account-scoped IDs such as openai-codex:<email>.

Re-authenticating one agent updates only that agent. Other agents keep stale local copies, which leads to configuration drift, duplicate profiles, and confusing failures depending on which agent is active.

Observed behavior

• each agent stores auth in its own ~/.openclaw/agents/<agentId>/agent/auth-profiles.json
• running openclaw models auth login --provider openai-codex on main created a new profile ID
• the old openai-codex:default profile was not automatically removed or migrated
• sibling agents kept only the old stale profile
• result: different agents silently diverged in credential state

Why this is problematic

• credentials have to be maintained repeatedly across agents
• stale OAuth profiles remain after successful re-authentication
• profile naming migrations are not normalized automatically
• there is no first-class built-in “main as source of truth” workflow
• failures can appear inconsistent depending on which agent handles a request

Expected behavior / possible improvements

Ideally, OpenClaw should provide one or more of the following:

1. a first-class shared/global auth profile store with explicit opt-in for agents
2. a built-in sync command to propagate selected provider profiles from one agent to others
3. automatic migration and cleanup when a provider changes profile naming conventions
4. a clearer distinction between the canonical active profile and obsolete retained profiles
5. an optional “inherit main agent credentials” mode for standard multi-agent setups, not only limited fallback cases

Reproduction

1. Set up multiple agents such as main, coding-monkey, dr-house, and others
2. Authenticate openai-codex while older :default profile naming is in use
3. Re-authenticate later on one agent with a newer OpenClaw version
4. Observe that a new profile like openai-codex:<email> is created only for that one agent
5. Observe that old openai-codex:default entries remain present locally and on sibling agents
6. Observe credential drift and inconsistent auth behavior across agents

Workaround

We had to create a local sync/cleanup skill that:

• treats main as the source of truth
• propagates canonical provider profiles to sibling agents
• deletes obsolete duplicate profiles
• normalizes order and lastGood