Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix SecretRef coverage gaps for several auth/config paths [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#68690•Fetched 2026-04-19 15:08:36
View on GitHub
Comments
0
Participants
1
Timeline
2
Reactions
0
Author
VACIncVACInc
Participants
VACIncVACInc
Timeline (top)
mentioned ×1subscribed ×1

A few config paths are currently not working with SecretRef in the current build.

Root Cause

A few config paths are currently not working with SecretRef in the current build.

RAW_BUFFERClick to expand / collapse

Summary

A few config paths are currently not working with SecretRef in the current build.

Affected config keys

  • messages.tts.providers.minimax.apiKey
  • hooks.token
  • channels.matrix.accessToken
  • plugins.entries.brave.config.webSearch.apiKey
  • plugins.entries.voice-call.config.twilio.authToken
  • plugins.entries.voice-call.config.tts.providers.openai.apiKey
  • plugins.entries.voice-call.config.tts.providers.elevenlabs.apiKey

Current status by key

Currently not working in live testing

  • messages.tts.providers.minimax.apiKey
    • SecretRef migration applies in config, but the TTS convert/runtime path does not currently resolve the exec: SecretRef correctly.
    • Observed effect: MiniMax TTS does not run and the system falls back to Microsoft TTS.

Currently not supported

  • hooks.token

Currently not working in runtime flows

  • channels.matrix.accessToken

    • Live SecretRef migration failed at runtime with:
      • TypeError: hasConfiguredSecretInput is not a function

  • plugins.entries.brave.config.webSearch.apiKey

    • Live Brave-only search failed after migration with:
      • tools.web.search.apiKey: unresolved SecretRef "exec:brave_plugin_1password:value"

Currently not working due to missing plugin SecretRef support

  • plugins.entries.voice-call.config.twilio.authToken
  • plugins.entries.voice-call.config.tts.providers.openai.apiKey
  • plugins.entries.voice-call.config.tts.providers.elevenlabs.apiKey

These voice-call paths exist in config, but are not currently working with SecretRef in the plugin’s present support surface.

Expected outcome

These paths should either:

  1. work end-to-end with SecretRef, or
  2. be clearly documented as unsupported until that support is added.

Notes

This issue includes full config keys only. No credentials are included.

CC @joshavant

extent analysis

TL;DR

Update the SecretRef resolution logic to correctly handle exec: references in the affected config keys.

Guidance

  • Review the SecretRef migration code to ensure it properly resolves exec: references in the TTS convert/runtime path for messages.tts.providers.minimax.apiKey.
  • Investigate the TypeError: hasConfiguredSecretInput is not a function error in the channels.matrix.accessToken runtime flow and update the code to correctly handle SecretRef inputs.
  • Verify that the tools.web.search.apiKey SecretRef is properly configured and resolved for the Brave-only search functionality.
  • Consider adding documentation to clearly indicate which config keys are currently unsupported with SecretRef until further development is completed.

Example

No code snippet is provided as the issue does not contain sufficient code context.

Notes

The issue highlights multiple config keys that are not working with SecretRef, and the causes vary by key. A thorough review of the SecretRef resolution logic and plugin support is necessary to address these issues.

Recommendation

Apply workaround: Update the SecretRef resolution logic and plugin support to handle the affected config keys, as a full fix is not immediately available and requires further development.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#file not found#serialization error#model compatibility#GPU setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING