OpenClaw Provider Authentication Failed
Fix a provider login, API key, OAuth profile, or service-environment mismatch without repeatedly rotating the wrong credential.
A provider probe or model turn returns 401, unauthorized, invalid credential, expired token, or no usable authentication profile.
Identify the exact provider and auth profile named by the failing route. Replacing an OpenAI key cannot repair an Anthropic route or an older agent-specific OAuth profile.
Inspect the resolved route
openclaw models status
openclaw config get agents.defaults.model
openclaw status --allCheck whether the credential comes from OpenClaw configuration, an auth profile, or the Gateway service environment. An interactive shell may have a valid environment variable while the managed service still has the old value.
Re-authenticate the correct profile
Use the provider’s current Control UI or CLI authentication flow. Do not paste secrets into logs or command history when a masked prompt or secret store is available.
If re-authentication succeeds but older agents still fail, inspect for stale per-agent auth shadows. Run openclaw doctor and review any proposed repair before applying it.
Restart the managed Gateway after changing a service environment credential, then run a live provider probe.
Expected result
- Model status resolves the expected provider and model.
- The provider connection test succeeds.
- A fresh direct turn works.
- Existing agents no longer resolve an obsolete auth profile.
If authentication succeeds but requests return 429, move to Rate limit 429 instead of rotating the credential again.
Source notes
Technical facts on this page were checked against primary sources.