Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Serialise OAuth refresh token usage per provider to prevent race conditions [3 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#62198•Fetched 2026-04-08 03:07:46
View on GitHub
Comments
3
Participants
2
Timeline
5
Reactions
0
Author
Stache73Stache73
Participants
sharkqwysharkqwyStache73Stache73
Timeline (top)
commented ×3closed ×1cross-referenced ×1

Fix Action

Workaround

Stagger cron job schedules so jobs using the same provider don't fire at the same :00 minute. This reduces but doesn't eliminate the race window.

RAW_BUFFERClick to expand / collapse

Problem

When multiple cron jobs using the same provider (e.g. openai-codex) fire simultaneously and the access token has expired, they all race to use the refresh token at the same time. OAuth refresh tokens are single-use — the first request succeeds and invalidates the token, causing all subsequent requests to fail with refresh_token_reused.

Observed behaviour

  • 3 openai-codex/gpt-5.4 cron jobs failed with OAuth 401 — refresh_token_reused within ~10 minutes
  • The gateway's fallback chain kicked in and routed to google-gemini-cli/gemini-3.1-pro-preview (so the jobs succeeded), but the primary provider was effectively dead until a gateway restart resync'd the tokens

Expected behaviour

The gateway should serialise (mutex/queue) refresh token usage per provider, so that:

  1. The first request to detect an expired token initiates the refresh
  2. All other concurrent requests for the same provider wait for the refresh to complete
  3. All requests then use the new access token

This is a standard pattern for OAuth client libraries (e.g. a "token refresh lock").

Workaround

Stagger cron job schedules so jobs using the same provider don't fire at the same :00 minute. This reduces but doesn't eliminate the race window.

Environment

  • OpenClaw v2026.3.13
  • Windows 10
  • Provider: openai-codex (OAuth via .codex/auth.json)
  • 8+ cron jobs using the same provider

extent analysis

TL;DR

Implement a token refresh lock or mutex to serialize refresh token usage per provider, ensuring that only one request can refresh the token at a time.

Guidance

  • Introduce a locking mechanism (e.g., mutex or semaphore) to synchronize access to the refresh token for each provider, preventing concurrent refresh attempts.
  • Modify the cron job execution to wait for the refresh token to be updated before proceeding, if another job is currently refreshing the token.
  • Consider implementing a queue to hold requests that are waiting for the token refresh to complete, ensuring that all requests use the new access token.
  • Review the OpenClaw documentation to see if there are any built-in features or configurations that can help mitigate this issue.

Example

import threading

class TokenRefresher:
    def __init__(self, provider):
        self.provider = provider
        self.lock = threading.Lock()
        self.access_token = None

    def refresh_token(self):
        with self.lock:
            # Refresh token logic here
            self.access_token = "new_token"

    def get_access_token(self):
        if not self.access_token:
            self.refresh_token()
        return self.access_token

Notes

The provided workaround of staggering cron job schedules can reduce the likelihood of the issue occurring but does not eliminate the problem entirely. A more robust solution involves implementing a token refresh lock or mutex.

Recommendation

Apply a workaround by implementing a token refresh lock or mutex to serialize refresh token usage per provider, as this will prevent the refresh_token_reused error and ensure that all requests use the new access token.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#model compatibility#GPU setup#container setup#orchestration issue#cache issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix Serialise OAuth refresh token usage per provider to prevent race conditions [3 comments, 2 participants]