Remove plaintext secrets from config | Friends of the Crustacean 🦞🤝 | Page 1

undone lotus May 28, 2026, 5:25 PM

#

openclaw@ubuntu ~ [1]> openclaw secrets audit
│
◇

OpenClaw 2026.5.27 (27ae826) — If it's repetitive, I'll automate it; if it's hard, I'll bring jokes and a rollback plan.

Secrets audit: findings. plaintext=6, unresolved=0, shadowed=0, legacy=0.

[PLAINTEXT_FOUND] /home/openclaw/.openclaw/openclaw.json:gateway.auth.token gateway.auth.token is stored as plaintext.
[PLAINTEXT_FOUND] /home/openclaw/.openclaw/openclaw.json:models.providers.<PROVIDER I USE>.apiKey models.providers.<PROVIDER I USE>.apiKey is stored as plaintext.
[PLAINTEXT_FOUND] /home/openclaw/.openclaw/openclaw.json:channels.nextcloud-talk.botSecret channels.nextcloud-talk.botSecret is stored as plaintext.
[PLAINTEXT_FOUND] /home/openclaw/.openclaw/agents/main/agent/auth-profiles.json:profiles.<PROVIDER I DON'T USE ANYMORE>:default.key Auth profile API key is stored as plaintext.
[PLAINTEXT_FOUND] /home/openclaw/.openclaw/agents/main/agent/auth-profiles.json:profiles.<PROVIDER I DON'T USE ANYMORE>:default.key Auth profile API key is stored as plaintext.
[PLAINTEXT_FOUND] /home/openclaw/.openclaw/agents/main/agent/models.json:providers.<PROVIDER I USE>.apiKey models.json provider apiKey is stored as plaintext

I am not even using mistral and openai anymore. how to remove them? can i just delete them?

tepid jungleBOT May 28, 2026, 5:25 PM

#

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

past rainBOT May 28, 2026, 5:25 PM

#

topaz hatchBOT May 28, 2026, 5:26 PM

#

undone lotus openclaw@ubuntu ~ [1]> openclaw secrets audit │ ◇ OpenClaw 2026.5.27 (27ae826) ...

Yes, if you truly do not use those providers anymore, removing those saved auth profiles is the right fix. Prefer the CLI over hand-editing JSON:

openclaw infer model auth logout --provider openai
openclaw infer model auth logout --provider mistral
openclaw secrets audit

That command removes saved auth profiles for that provider from the default agent’s auth-profiles.json and clears related auth state.

If you also configured those providers in openclaw.json, remove those config entries too:

openclaw config unset models.providers.openai
openclaw config unset models.providers.mistral
openclaw config validate

topaz hatchBOT May 28, 2026, 5:26 PM

#

undone lotus openclaw@ubuntu ~ [1]> openclaw secrets audit │ ◇ OpenClaw 2026.5.27 (27ae826) ...

openclaw secrets audit

Manual editing is possible, but be careful: in ~/.openclaw/agents/main/agent/auth-profiles.json, remove only the relevant entries under profiles, e.g. openai:... / mistral:..., and any matching order, lastGood, or usageStats entries if present. Don’t delete the whole file unless you want to wipe all model auth for that agent.

The remaining findings are separate:

gateway.auth.token, your active provider apiKey, and nextcloud-talk.botSecret are still plaintext. Use openclaw secrets configure if you want to migrate them to env/file/exec SecretRefs.
agents/main/agent/models.json is generated runtime model config. If it still has an apiKey after migrating/removing config, restart/reload and rerun audit; don’t use it as the source of truth.

Docs: https://docs.openclaw.ai/gateway/secrets and https://docs.openclaw.ai/cli/config

topaz hatchBOT May 28, 2026, 5:27 PM

#

tepid jungle

Yep, exactly. If this fixed it, marking the solution helps Answer Overflow index the right answer for the next person.

undone lotus May 28, 2026, 5:30 PM

#

what is the best way to store these? should i just move them all to .env?

topaz hatchBOT May 28, 2026, 5:31 PM

#

undone lotus what is the best way to store these? should i just move them all to .env?

Short answer: .env is fine for a single-user/self-hosted setup, but don’t put plaintext secrets directly in openclaw.json if you can avoid it.

Best practical tiers:

Good/simple: put secrets in ~/.openclaw/.env, lock it down, and point config at env SecretRefs.

chmod 600 ~/.openclaw/.env
openclaw secrets configure
openclaw secrets audit

Use ~/.openclaw/.env, not a random project .env, because the gateway daemon reads the global OpenClaw env file even when it doesn’t inherit your shell environment.

Better for servers: use a real secret store via SecretRef exec or file provider, e.g. 1Password CLI, Vault, SOPS, or a protected JSON secrets file. That keeps OpenClaw config as references, not values.
Avoid: leaving API keys/tokens as plaintext inside openclaw.json, auth-profiles.json, or generated models.json.

topaz hatchBOT May 28, 2026, 5:31 PM

#

undone lotus what is the best way to store these? should i just move them all to .env?

So yes, moving them to ~/.openclaw/.env is a reasonable improvement, especially if this is just your box. The clean way is to let openclaw secrets configure create the SecretRefs and scrub the old plaintext where supported, then rerun openclaw secrets audit --check.

Docs: https://docs.openclaw.ai/gateway/secrets and https://docs.openclaw.ai/help/faq#env-vars-and-env-loading

undone lotus May 28, 2026, 5:32 PM

#

openclaw@ubuntu ~> openclaw secrets configure
│
◇

OpenClaw 2026.5.27 (27ae826) — Shell yeah—I'm here to pinch the toil and leave you the glory.

│
◇ Configure secret providers (only env refs are available until file/exec providers are added)
│ Continue
│
◇ Select credential field
│ gateway.auth.token
│
◇ Secret source
│ env
│
◆ Provider alias
│ default█
└
what to set as Provider alias since this isn't really a provider? and what to set later as Secret id?

topaz hatchBOT May 28, 2026, 5:32 PM

#

undone lotus openclaw@ubuntu ~> openclaw secrets configure │ ◇ OpenClaw 2026.5.27 (27ae826) ...

Use default there.

In this screen, “Provider alias” means the SecretRef resolver provider, not your model provider. For env vars, default is the normal alias, meaning “read from the environment”.

For gateway.auth.token, set the Secret id to the env var name that contains the token, usually:

OPENCLAW_GATEWAY_TOKEN

Then make sure that env var exists for the gateway. For a daemon/server setup, the practical place is:

~/.openclaw/.env

Example:

topaz hatchBOT May 28, 2026, 5:32 PM

#

undone lotus openclaw@ubuntu ~> openclaw secrets configure │ ◇ OpenClaw 2026.5.27 (27ae826) ...

OPENCLAW_GATEWAY_TOKEN=your-token-here
NEXTCLOUD_TALK_BOT_SECRET=your-nextcloud-secret-here
OPENROUTER_API_KEY=your-model-key-here

Then:

chmod 600 ~/.openclaw/.env
openclaw secrets configure
openclaw secrets audit

So the mapping is basically:

Provider alias: default

topaz hatchBOT May 28, 2026, 5:32 PM

#

undone lotus openclaw@ubuntu ~> openclaw secrets configure │ ◇ OpenClaw 2026.5.27 (27ae826) ...

Secret id: the env var name, like OPENCLAW_GATEWAY_TOKEN

Docs: https://docs.openclaw.ai/gateway/secrets

undone lotus May 28, 2026, 5:34 PM

#

openclaw@ubuntu ~> openclaw secrets configure
│
◇

OpenClaw 2026.5.27 (27ae826) — Shell yeah—I'm here to pinch the toil and leave you the glory.

│
◇ Configure secret providers (only env refs are available until file/exec providers are added)
│ Continue
│
◇ Select credential field
│ gateway.auth.token
│
◇ Secret source
│ env
│
◇ Provider alias
│ default
│
◇ Secret id
│ OPENCLAW_GATEWAY_TOKEN
Secrets configure failed: Environment variable "OPENCLAW_GATEWAY_TOKEN" is missing or empty.. Re-run openclaw secrets audit before applying changes.

topaz hatchBOT May 28, 2026, 5:34 PM

#

undone lotus openclaw@ubuntu ~> openclaw secrets configure │ ◇ OpenClaw 2026.5.27 (27ae826) ...

That error is expected: secrets configure preflights the SecretRef before it writes anything, so the env var has to exist first.

Do this, using the token value that is currently in your config. Don’t paste the token here.

mkdir -p ~/.openclaw
nano ~/.openclaw/.env
chmod 600 ~/.openclaw/.env

Add a line like:

OPENCLAW_GATEWAY_TOKEN=actual-token-value-here

Then rerun:

topaz hatchBOT May 28, 2026, 5:34 PM

#

undone lotus openclaw@ubuntu ~> openclaw secrets configure │ ◇ OpenClaw 2026.5.27 (27ae826) ...

openclaw secrets configure
openclaw secrets audit

If the CLI still says it can’t see the env var, run it once with the variable exported in the same shell:

set -a
source ~/.openclaw/.env
set +a
openclaw secrets configure

Same pattern for the others: pick an env var name, put the current secret value in ~/.openclaw/.env, then map the config field to that env var. Example names: NEXTCLOUD_TALK_BOT_SECRET, OPENROUTER_API_KEY, etc.

undone lotus May 28, 2026, 5:38 PM

#

always leave provider as default? what is the purpose of that field?

topaz hatchBOT May 28, 2026, 5:38 PM

#

undone lotus always leave provider as default? what is the purpose of that field?

For env vars: yes, usually leave it as default.

That field exists because SecretRefs support multiple secret resolver providers, not just env vars. The shape is:

{ source: "env" | "file" | "exec", provider: "default", id: "..." }

So:

source = what kind of secret backend to use: env, file, or exec
provider = which configured backend alias to use
id = the key/path/name inside that backend

For plain env vars, default means “read from the normal environment”. The id is the env var name, e.g. OPENCLAW_GATEWAY_TOKEN.

The provider alias matters when you add more than one resolver, for example:

topaz hatchBOT May 28, 2026, 5:38 PM

#

undone lotus always leave provider as default? what is the purpose of that field?

secrets: {
  providers: {
    default: { source: "env" },
    prodfile: { source: "file", path: "/etc/openclaw/secrets.json", mode: "json" },
    onepassword: { source: "exec", command: "/usr/bin/op", args: ["read", "op://..."] }
  }
}

Then provider: "prodfile" or provider: "onepassword" tells OpenClaw where to resolve that secret from.

For your current setup, keep source=env, provider=default, and vary only the Secret id/env var name.

undone lotus May 28, 2026, 5:41 PM

#

after migrating everything to env it still lists: /home/openclaw/.openclaw/agents/main/agent/models.json

topaz hatchBOT May 28, 2026, 5:42 PM

#

undone lotus after migrating everything to env it still lists: /home/openclaw/.openclaw/agent...

That usually means models.json is stale generated state. After an env SecretRef migration, SecretRef-managed model keys should be persisted as markers like the env var name, not the resolved secret.

Try this sequence:

openclaw secrets reload
openclaw models status
openclaw secrets audit

openclaw models status is useful here because it syncs/regenerates the agent models.json view from the current source config.

If it still reports agents/main/agent/models.json:providers.<provider>.apiKey, check whether that provider is still configured as plaintext somewhere:

openclaw config get models.providers.<provider>.apiKey

topaz hatchBOT May 28, 2026, 5:42 PM

#

undone lotus after migrating everything to env it still lists: /home/openclaw/.openclaw/agent...

openclaw models status

If config get prints the actual key, it was not migrated; map that field to the env var with openclaw secrets configure.

If openclaw.json is clean and only models.json remains, you can move the generated file aside and let OpenClaw rebuild it:

mv ~/.openclaw/agents/main/agent/models.json ~/.openclaw/agents/main/agent/models.json.bak
openclaw models status
openclaw secrets audit

Don’t paste the contents of models.json here, since it may contain real keys. If you paste anything, paste only the audit line with the provider name redacted.

undone lotus May 28, 2026, 5:46 PM

#

okay moving did it. can I remove the bak since it contains plaintext creds and it works now?

topaz hatchBOT May 28, 2026, 5:46 PM

#

undone lotus okay moving did it. can I remove the bak since it contains plaintext creds and i...

Yes. If OpenClaw rebuilt models.json and openclaw secrets audit is clean, remove the backup because it still contains plaintext credentials.

Prefer a recoverable delete if you have trash installed:

trash ~/.openclaw/agents/main/agent/models.json.bak
openclaw secrets audit

If trash is not available, this is one of the cases where permanent delete is reasonable because the file contains secrets:

rm ~/.openclaw/agents/main/agent/models.json.bak
openclaw secrets audit

Also rotate any key that was exposed in plaintext if the machine/user account might not be fully trusted. If this solved the thread, please right-click the solution message -> Apps -> ✅ Mark Solution so Answer Overflow indexes it.

undone lotus May 28, 2026, 5:53 PM

#

okay summarize for future travelers so i can mark one message (backup models.json, create .env and enter everything there and then run secrets configure)

topaz hatchBOT May 28, 2026, 5:53 PM

#

undone lotus okay summarize for future travelers so i can mark one message (backup models.jso...

Summary for future travelers:

Put the secrets in the OpenClaw global env file:

mkdir -p ~/.openclaw
nano ~/.openclaw/.env
chmod 600 ~/.openclaw/.env

Example entries:

OPENCLAW_GATEWAY_TOKEN=...
NEXTCLOUD_TALK_BOT_SECRET=...
OPENROUTER_API_KEY=...

topaz hatchBOT May 28, 2026, 5:53 PM

#

undone lotus okay summarize for future travelers so i can mark one message (backup models.jso...

Run the migration helper:

openclaw secrets configure

For env refs, use:

Secret source: env
Provider alias: default
Secret id: the env var name, e.g. OPENCLAW_GATEWAY_TOKEN

Verify:

openclaw secrets audit

topaz hatchBOT May 28, 2026, 5:53 PM

#

undone lotus okay summarize for future travelers so i can mark one message (backup models.jso...

If audit still reports plaintext in generated agents/main/agent/models.json, move it aside and let OpenClaw rebuild it:

mv ~/.openclaw/agents/main/agent/models.json ~/.openclaw/agents/main/agent/models.json.bak
openclaw models status
openclaw secrets audit

Once audit is clean and everything still works, delete the backup because it may contain plaintext credentials:

rm ~/.openclaw/agents/main/agent/models.json.bak
openclaw secrets audit

Docs: https://docs.openclaw.ai/gateway/secrets

#Remove plaintext secrets from config