Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Schema needed for claude-cli provider entry in auth-profiles.json — getting FailoverError after setting claude-cli/<model> as primary [3 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#71527•Fetched 2026-04-26 05:11:52
View on GitHub
Comments
3
Participants
2
Timeline
5
Reactions
0
Author
davidatashroo-teddydavidatashroo-teddy
Participants
davidatashroo-teddydavidatashroo-teddyobviyusobviyus
Timeline (top)
commented ×3closed ×1renamed ×1

Fix Action

Fix / Workaround

Workarounds tried that did NOT work

  • jq edits to openclaw.json
  • jq edits to auth-profiles.json
  • Gateway stop/start (5+ times)
  • openclaw doctor --fix
  • launchctl bootout to stop respawn loop
  • Deleting agent:main:main from sessions.json (gateway recreates it)
  • Token re-paste from fresh claude setup-token
RAW_BUFFERClick to expand / collapse

How to register Claude Max OAuth token (sk-ant-oat01-) in OpenClaw 2026.4.15 — gateway rejects "token" key in openclaw.json auth.profiles

Environment

  • OpenClaw version: 2026.4.15 (041266a)
  • OS: macOS 15.5 (arm64), Apple Silicon Mac Mini
  • Node: 22.22.0
  • Channel: stable (default)
  • Auth profiles in use: anthropic:default (API key) and anthropic:manual (Claude Max subscription OAuth)

What I'm trying to do

Migrate from API key billing (anthropic:default with sk-ant-api03-) to Claude Max subscription OAuth (anthropic:manual with sk-ant-oat01-) for cost savings. Brain swapped from google/gemini-3.1-pro-preview to anthropic/claude-sonnet-4-6. Want subscription auth as primary, API key as explicit-only fallback.

Steps taken

  1. Generated OAuth token via claude setup-token on MacBook Air — got valid 1-year sk-ant-oat01-... token.
  2. Token correctly placed in ~/.openclaw/agents/main/auth-profiles.json under profiles["anthropic:manual"].token (verified via jq).
  3. openclaw.json contains auth.profiles.anthropic:manual with provider="anthropic" and mode="token" (no token value).
  4. Set agents.defaults.model.primary to anthropic/claude-sonnet-4-6.
  5. Set fallbacks to [anthropic/claude-opus-4-7, google/gemini-3.1-pro-preview].
  6. Auth order locked via openclaw models auth order set --provider anthropic anthropic:manual.

What's broken

  • Telegram session agent:main:main keeps falling back to google/gemini-3.1-pro-preview using GEMINI_API_KEY.
  • Gateway log shows HTTP 401 authentication_error: Invalid bearer token from Anthropic auth attempts (since 4/13/26).
  • Something repeatedly writes the OAuth token VALUE into openclaw.json (auth.profiles.anthropic:manual.token field), causing gateway to abort with: auth.profiles.anthropic:manual: Unrecognized key: "token".
  • Each time we clean openclaw.json and restart, the bad field reappears.
  • LaunchAgent auto-respawns gateway, reloading bad config.

Questions

  1. What's the canonical command to register a Claude Max OAuth token (sk-ant-oat01-)? Is it openclaw models auth paste-token --provider anthropic or something else?
  2. Should the token VALUE live in openclaw.json or only in auth-profiles.json?
  3. What process re-serializes auth profile data into openclaw.json? Is there a hot-reload hook or sync that copies from auth-profiles.json into openclaw.json incorrectly?
  4. Why does gateway accept "mode": "token" in openclaw.json's auth.profiles but reject "token": "<value>"? Is this a schema bug or expected?
  5. What's the right way to verify subscription OAuth auth is actually working before declaring success?

Files affected

  • ~/.openclaw/openclaw.json (gets bad rewrite)
  • ~/.openclaw/agents/main/auth-profiles.json (correct token location)

Backups available

  • ~/.openclaw/openclaw.json.bak.1 (clean, pre-contamination, restored to)
  • ~/.openclaw/agents/main/auth-profiles.json.bak-20260425_024118 (with fresh OAuth token)

Workarounds tried that did NOT work

  • jq edits to openclaw.json
  • jq edits to auth-profiles.json
  • Gateway stop/start (5+ times)
  • openclaw doctor --fix
  • launchctl bootout to stop respawn loop
  • Deleting agent:main:main from sessions.json (gateway recreates it)
  • Token re-paste from fresh claude setup-token

Current state

Gateway running on Sonnet at config level (gateway log shows "agent model: anthropic/claude-sonnet-4-6") but Telegram session falls back to Gemini API key. OAuth token verified correct (first 20 chars sk-ant-oat01-qBcUw4q, last 8 chars 8TUj5QAA, generated 2026-04-25 valid 1 year).

extent analysis

TL;DR

The most likely fix is to remove the "token" key from the openclaw.json file and ensure the OAuth token is only stored in auth-profiles.json, as the gateway rejects the "token" key in openclaw.json.

Guidance

  • Verify that the auth-profiles.json file contains the correct OAuth token and that the openclaw.json file does not have a "token" key.
  • Check the documentation for the openclaw command to determine the correct way to register a Claude Max OAuth token, as the issue mentions uncertainty about the canonical command.
  • Investigate the process that re-serializes auth profile data into openclaw.json and determine if there is a hot-reload hook or sync that is copying the token incorrectly.
  • Ensure that the mode field in openclaw.json is set to "token" and that the gateway is configured to use the subscription OAuth auth as primary.

Example

No code snippet is provided as the issue does not require a code change, but rather a configuration correction.

Notes

The issue may be related to a schema bug or an expected behavior in the openclaw configuration, and further investigation is needed to determine the root cause.

Recommendation

Apply a workaround by removing the "token" key from openclaw.json and ensuring the OAuth token is only stored in auth-profiles.json, as this is the most likely fix based on the provided information.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#dependency conflict#environment setup#docker error#permission error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix Schema needed for claude-cli provider entry in auth-profiles.json — getting FailoverError after setting claude-cli/<model> as primary [3 comments, 2 participants]