openclaw - 💡(How to fix) Fix QQ Bot channel fails with 'invalid appid or secret' after upgrade to v2026.4.23 when using secretref [1 comments, 2 participants]

Bug Description

After upgrading OpenClaw from v2026.4.21 to v2026.4.23, the QQ Bot channel fails to connect with error:

Failed to get access_token: {"code":100016,"message":"invalid appid or secret"}

Root Cause

The secretref:/QQBOT_XXX_CLIENT_SECRET format in openclaw.json is not being properly resolved by the QQ Bot plugin in v2026.4.23. The raw secretref:/... string appears to be passed directly to the QQ OpenAPI instead of being resolved to the actual secret value from secrets.json.

Workaround

Hardcoding the secret value directly in openclaw.json (bypassing secretref:) fixes the issue:

"clientSecret": "<actual-secret-value>"  // works
// vs
"clientSecret": "secretref:/QQBOT_NUONUO_CLIENT_SECRET"  // fails

Reproduction Steps

1. Configure QQ Bot with secretref:/QQBOT_XXX_CLIENT_SECRET in openclaw.json
2. Store actual secret in secrets.json
3. Upgrade from v2026.4.21 to v2026.4.23
4. Restart Gateway
5. QQ Bot connection fails with "invalid appid or secret"

Environment

• OS: Windows 11 (10.0.26200)
• OpenClaw: v2026.4.23 (upgraded from v2026.4.21)
• Node.js: v24.14.0
• QQ Bot plugin: @openclaw/qqbot v2026.4.20
• Channel config: channels.qqbot.accounts.nuonuo.clientSecret: "secretref:/QQBOT_NUONUO_CLIENT_SECRET"

Additional Investigation

• secrets.json encoding is correct (UTF-8, no BOM, pure ASCII)
• The secret value is clean (no hidden characters or line breaks)
• Direct API call with the same appId + secret succeeds (confirmed via Python urllib)
• The resolveQQBotAccount() function in config--Jdei9fe.js correctly reads the secretref: value and calls adapter.resolveSecretInputString(), but the resolved value appears to be empty or incorrect.