OpenClaw Main Stops Undeclared Credential Failover and Cools Failed Inline Keys

OpenClaw has merged a consequential correction to provider credential selection: a bare API key found in the Gateway environment can no longer become an unstated backup behind auth profiles the operator explicitly declared.

A second merged change adds persistent cooldowns for inline models.providers.<id>.apiKey credentials after provider auth or billing failures. A follow-up, PR #119147, now prevents transient timeouts and other non-credential provider errors from placing those inline keys into shared cooldown. Together, the fixes replace invisible account switching and over-broad key suppression with explicit authorization and availability rules.

These changes are on main. The two GitHub correction releases published on 4 August describe earlier 2026.7.1 package corrections and do not establish that these later merges are in a packaged build. Identify a containing release before changing production.

The dangerous path was invisible account switching

PR #118458 addresses a regression limited upstream to the 2026.7.2 prereleases. An operator could declare subscription-backed auth profiles while an unrelated API key for the same provider happened to exist in the Gateway process environment. If the declared profile became unusable, the runtime could advance to the undeclared environment key.

That is not ordinary failover. The alternate credential may bill another account, and the upstream report says status could continue presenting the subscription identity while metered API usage accrued elsewhere.

The repaired rule separates provenance from authorization:

• a credential can be environment-sourced because the operator deliberately referenced ${VAR} in configuration;
• a bare environment credential can still power the documented zero-config path when no profiles are declared; but
• an ambient key that configuration never names cannot inherit traffic behind declared profiles.

Declared auth.order still controls failover among declared profiles. The change is not reported to affect the current 2026.7.1 GA line.

Interpretation: finding a secret proves where it came from, not that the operator authorized it for this route. Billing identity must follow declared policy rather than process ambience.

Inline keys now acquire durable cooldown state

PR #88709 applies provider-level failure state to literal inline keys, environment markers and SecretRefs used by models.providers.<id>.apiKey. After a qualifying billing or authentication failure, the key is hidden from model browsing and model-backed tool authorization while its cooldown is active.

A healthy stored profile remains eligible as fallback. The upstream production-path proof records an initial five-hour billing window, with repeated failures able to escalate toward a 24-hour cap.

There is an important recovery caveat: the merged design is expiry-driven. Because a cooled key is not sent another request, restoring credit does not itself generate a successful request that could clear the state early. An operator who fixes billing may still need to wait for expiry or switch to a healthy declared profile. Do not repeatedly restart the Gateway expecting that to erase durable auth state.

PR #119147 narrows which failures can create that state for an inline key. Authentication and billing failures still qualify; provider timeouts and other non-credential failures no longer disable the configured key for later sessions merely because provider-scoped failure state was recorded.

Stored auth profiles retain their existing rotation policy. The follow-up is specifically about inline configured keys, so acceptance must exercise both credential classes rather than assuming one result proves the other.

Media credentials use the configured provider boundary

PR #118761 is a related availability correction. Media operations now recognize configured provider credentials across the owning provider boundary, including shared DashScope policy, instead of deciding readiness from the wrong credential surface.

That does not weaken the declared-versus-ambient rule. It means the provider operation should see credentials the operator actually configured for that owner, without borrowing an undeclared key from elsewhere.

Operator action

For any 2026.7.2 beta deployment or source build:

1. inventory provider-related environment variables inherited by the Gateway service;
2. compare them with auth.profiles, auth.order and explicit provider credential references;
3. inspect billing consoles for unexplained account switching during profile failures;
4. stage a containing revision with synthetic credentials and prove declared-profile failure does not select a bare ambient key;
5. force a harmless simulated billing/auth failure and confirm the inline key becomes unavailable while a healthy declared profile can still run; and
6. force a transient timeout and confirm the inline key remains eligible for a later session; and
7. document the cooldown window in incident runbooks so restored credit is not mistaken for immediate recovery.

Never print full environment blocks, auth stores or resolved secrets into CI logs. Record credential identity and source class, not secret material.

Evidence and limits

The official GitHub API records confirm all three pull requests were merged and provide the described production-path and focused test evidence. OpenClaw Academy did not trigger a real paid-provider billing failure or inspect an operator auth store.

Relevant collector IDs are 37235/37122, 37221/37105, and 36864/36749/36810. IDs 40385 and 40356 identify the cooldown-scope follow-up.

Bottom line

An environment variable is not an authorized billing fallback merely because the Gateway can see it. Move a prerelease or source deployment only to a containing build, then prove traffic stays on declared identities and that cooled inline keys fail visibly without suppressing healthy configured alternatives.