OpenClaw Model Authentication Failed
Diagnose an invalid, expired, missing, or misrouted model provider credential without exposing the secret.
A model call returns unauthorized, invalid API key, expired token, missing credential, or no usable auth profile.
Do not paste the credential into logs or a public issue. Inspect which provider and auth profile OpenClaw actually selected.
Check model and auth state
openclaw models status
openclaw status --allConfirm the exact provider/model reference. A valid key for one provider or account does not authorize another endpoint.
Reauthenticate through the supported flow
Use onboarding or the model-auth command offered by your installed version. This avoids storing a token in the wrong file or under the wrong provider id.
openclaw onboardDistinguish auth from policy
“Model is not allowed” is a model-policy rejection, not an invalid key. Inspect agents.defaults.modelPolicy.allow and use a permitted full provider/model reference.
Rotate exposed credentials
If the key appeared in terminal history, a screenshot, repository, or chat, revoke it at the provider and create a new one. Editing the local config does not invalidate the leaked secret.
Expected result
openclaw models status shows usable authentication for the intended provider, and a test model turn completes without a 401/403 or policy rejection.
Source notes
Technical facts on this page were checked against primary sources.