[Bug] Anthropic setup-token auth returns 401 Invalid bearer token on 2026.2.21-2 (isolated profile repro)

[bigeasyfreeman]

Environment

• OpenClaw: 2026.2.21-2 (35a57bc)
• OS: macOS 26.3 (arm64)
• Node: 25.5.0

Summary
Anthropic auth via setup-token is accepted and stored, but runtime agent calls fail with:
HTTP 401 authentication_error: Invalid bearer token

I can reproduce this in a clean isolated profile, so this does not appear to be session/model leakage.

Repro steps

1. Create/use isolated profile:
   openclaw --profile anth-test status

2. Configure Anthropic model/auth in that profile (token flow):
   openclaw --profile anth-test models auth setup-token

3. Confirm model/auth state:
   openclaw --profile anth-test models status

• Default model: anthropic/claude-sonnet-4-6
• Auth store shows anthropic token profile(s)

4. Run agent turn:
   openclaw --profile anth-test agent --agent main --message "Reply with exactly: anthropic test ok" --json

Observed

• agentMeta.provider = anthropic
• agentMeta.model = claude-sonnet-4-6
• payload text:
  HTTP 401 authentication_error: Invalid bearer token (request_id: req_...)

Expected

• Successful Anthropic model response for valid setup-token auth.

Additional notes

• I also tested with a separate anth-test gateway port and explicit gateway env targeting; same 401 behavior once provider/model were Anthropic.
• Tokens were rotated during testing.
• models auth login is not usable in this environment because CLI reports:
  “No provider plugins found. Install one via openclaw --profile anth-test plugins install”.

Potentially relevant

• setup-token flow writes auth profile(s), but runtime bearer appears rejected by Anthropic API.
• Could be token type mismatch, token ingestion/normalization issue, or provider auth handling regression in 2026.2.21-2.

[pressberg]

Environment

OpenClaw: 2026.2.24 (install method: npm)
OS: Ubuntu 24.04.4 LTS (x86_64)
Node: v22.22.0
Claude Code CLI: 2.1.52
Claude plan: Max (subscription)

What I'm trying to do
Use Claude Max subscription via claude setup-token → OpenClaw setup-token flow (no API key)
Steps to reproduce

Generated token: claude setup-token on Mac mini (macOS, arm64)
On gateway host (DigitalOcean Ubuntu droplet): openclaw models auth paste-token --provider anthropic
Also tried: openclaw onboard --auth-choice setup-token and openclaw models auth setup-token --provider anthropic
Status shows token present: token=2, oauth=0, api_key=0
Removed API key, restarted gateway
Agent call fails: HTTP 401 authentication_error: Invalid bearer token

Observed

With only setup-token auth: HTTP 401 Invalid bearer token
If API key is present, Anthropic calls succeed but are billed to API usage (not subscription)

Expected
Setup-token should work for Anthropic requests (subscription billing), without requiring an API key.
Probe output
Unable to get a clean probe of the setup-token — currently restored to API key auth to keep the bot running. When setup-token was the only auth profile, agent calls returned 401 immediately. Behavior matches OP exactly.

[flowline905]

Environment
OpenClaw: 2026.2.25 (also reproduced on 2026.2.22-2 (45febec))
OS: Ubuntu Linux (VPS)
Gateway: systemd user service
Config path: ~/.openclaw/openclaw.json
Agent dir: ~/.openclaw/agents/main/agent
Default model: anthropic/claude-sonnet-4-6

Summary
I’m trying to use my Claude subscription via the setup-token flow (token stored as auth-profiles.json entry of type token, token prefix sk-ant-o... masked). OpenClaw shows the token profiles and openclaw models status --probe --probe-provider anthropic reports OK for both token profiles, but any real agent turn results in:
HTTP 401 authentication_error: Invalid bearer token (request_id: req_...)

So auth probe succeeds, but the actual inference request fails with 401.

Auth / model configuration (sanitized)
openclaw models status shows:
Default: anthropic/claude-sonnet-4-6
Anthropic auth profiles: 2 profiles, both token type (no api_key), stored in:
~/.openclaw/agents/main/agent/auth-profiles.json

Config allowlist:
{
"openrouter/auto": { "alias": "OpenRouter" },
"openrouter/moonshotai/kimi-k2.5": {},
"anthropic/claude-sonnet-4-6": { "alias": "sonnet" }
}

No custom models.providers entry (built-in provider):
openclaw config get models.providers → Config path not found: models.providers

Gateway/service points to the same config:
openclaw gateway status --deep shows:
Config (cli): ~/.openclaw/openclaw.json
Config (service): ~/.openclaw/openclaw.json
Runtime: running, RPC probe: ok

Repro steps
Configure Anthropic subscription token via setup-token/paste-token (token stored as type token in auth-profiles.json).
Verify auth probe:
openclaw models status --probe --probe-provider anthropic

Run an actual model call:
openclaw agent --agent main --message "Reply with exactly: setup-token test ok" --json

Observed
openclaw models status --probe --probe-provider anthropic shows Status: ok for the Anthropic token profile(s)
openclaw agent … fails with:
HTTP 401 authentication_error: Invalid bearer token (request_id: req_011CYWvNNLLkA3mkPTuM6rMa) (example request_id)

Expected
If the auth probe is ok, real inference requests using the same provider/profile should succeed.

Notes / suspicion
This looks like either:
the probe is hitting a different endpoint / using different headers than the real request, or
setup-token handling is accepted by a probe but rejected by the normal request path (header/beta flags/token normalization mismatch), or
the probe is not representative of the real request auth mode.

Happy to run any debug build or provide logs; I can paste openclaw logs --follow around the failing request if needed (tokens redacted).

[Antoniaiaiaiaia]

Environment

• OpenClaw: 2026.2.25
• OS: macOS 15 Sequoia (darwin 24.6.0, arm64)
• Node: v24.13.1
• npm: 11.8.0

Summary

Hitting the same 401 Invalid bearer token error. My token is an OAuth Access Token (sk-ant-oat01- prefix), not a standard API key (sk-ant-api03-).

Steps to reproduce

1. Installed openclaw globally via npm:
   npm install -g openclaw@latest

2. Ran the onboarding wizard:
   openclaw onboard --install-daemon

3. Configured Anthropic model and entered OAuth Access Token (sk-ant-oat01-...) via the setup-token flow during onboarding.

4. Launched the TUI:
   openclaw

5. Sent any message to the agent.

Observed
run error: HTTP 401 authentication_error: Invalid bearer token (request_id: req_...)

The auth profile is written to ~/.openclaw/openclaw.json correctly with "mode": "token", but the token is rejected at runtime.

Workaround attempted

Setting ANTHROPIC_API_KEY environment variable in ~/.zshrc — still testing if this resolves the issue.

Notes

The token was freshly generated and confirmed valid. This appears to be the same token type mismatch / ingestion issue described in this report. Reproduces on a clean install with no prior openclaw configuration.

[LazerLance777]

Root Cause Found + 2-Line Fix

I traced the 401 through the full auth chain and found the issue in @mariozechner/pi-ai's Anthropic provider (node_modules/@mariozechner/pi-ai/dist/providers/anthropic.js).

The Problem

When pi-ai detects a setup-token (sk-ant-oat01-*), it enters "stealth mode" — setting Claude Code headers, system prompt, and tool names. However, the user-agent string includes an (external, cli) flag:

"user-agent": `claude-cli/${claudeCodeVersion} (external, cli)`,

This explicitly tells Anthropic's API server "I am NOT the real Claude Code." Anthropic's server-side validation checks this and rejects the request with 401 Unauthorized.

Additionally, the hardcoded version "2.1.2" is outdated (current Claude Code is 2.1.62+).

The Fix (2 lines)

File: <npm-global>/openclaw/node_modules/@mariozechner/pi-ai/dist/providers/anthropic.js

Change 1 — Update version (~line 35):

- const claudeCodeVersion = "2.1.2";
+ const claudeCodeVersion = "2.1.62";

Change 2 — Remove external flag (~line 421):

- "user-agent": `claude-cli/${claudeCodeVersion} (external, cli)`,
+ "user-agent": `claude-cli/${claudeCodeVersion}`,

Automated Patch Script

I created a gist with an automated fix script and detailed README:
https://gist.github.com/LazerLance777/89e678844333b42072dde5de5b53372e

curl -fsSL https://gist.githubusercontent.com/LazerLance777/89e678844333b42072dde5de5b53372e/raw/openclaw-max-fix.sh | bash

Tested & Confirmed Working

• OpenClaw 2026.2.26
• Claude Code 2.1.62
• Claude Max subscription
• macOS (Apple Silicon), Node.js 25.6.1
• Models tested: anthropic/claude-sonnet-4-5, anthropic/claude-opus-4-6

Note: This patches node_modules so it must be re-applied after openclaw update or npm install -g openclaw@latest. A proper fix would need to go into @mariozechner/pi-ai upstream.

[flowline905]

@LazerLance777 amazing work. Validated in my environment that this fix works.

Edit - appeared to work, but I don't think it did. See my comment below

[99Arrzel]

openclaw agent --agent main --message 'hello world'
Is working but UI and TUI still throwing HTTP 401 authentication_error: Invalid bearer token
Fun, I tried to restart the gateway but the problem persists, working in console, not working in web.

Requests through other channels (Whatsapp, telegram are working, just not web/tui)

[pressberg]

Root Cause Found + 2-Line Fix

I traced the 401 through the full auth chain and found the issue in @mariozechner/pi-ai's Anthropic provider (node_modules/@mariozechner/pi-ai/dist/providers/anthropic.js).

The Problem

When pi-ai detects a setup-token (sk-ant-oat01-*), it enters "stealth mode" — setting Claude Code headers, system prompt, and tool names. However, the user-agent string includes an (external, cli) flag:

"user-agent": claude-cli/${claudeCodeVersion} (external, cli),
This explicitly tells Anthropic's API server "I am NOT the real Claude Code." Anthropic's server-side validation checks this and rejects the request with 401 Unauthorized.

Additionally, the hardcoded version "2.1.2" is outdated (current Claude Code is 2.1.62+).

The Fix (2 lines)

File: <npm-global>/openclaw/node_modules/@mariozechner/pi-ai/dist/providers/anthropic.js

Change 1 — Update version (~line 35):

• const claudeCodeVersion = "2.1.2";

• const claudeCodeVersion = "2.1.62";
  Change 2 — Remove external flag (~line 421):

• "user-agent": claude-cli/${claudeCodeVersion} (external, cli),

• "user-agent": claude-cli/${claudeCodeVersion},

Automated Patch Script

I created a gist with an automated fix script and detailed README: https://gist.github.com/LazerLance777/89e678844333b42072dde5de5b53372e

curl -fsSL https://gist.githubusercontent.com/LazerLance777/89e678844333b42072dde5de5b53372e/raw/openclaw-max-fix.sh | bash

Tested & Confirmed Working

• OpenClaw 2026.2.26
• Claude Code 2.1.62
• Claude Max subscription
• macOS (Apple Silicon), Node.js 25.6.1
• Models tested: anthropic/claude-sonnet-4-5, anthropic/claude-opus-4-6

Note: This patches node_modules so it must be re-applied after openclaw update or npm install -g openclaw@latest. A proper fix would need to go into @mariozechner/pi-ai upstream.

Amazing, this worked for me too! Great work!

[flowline905]

Sorry, I'm not convinced it works. I'm getting 401s again, and I believe the recommended approach of messaging the agent via CLI is hitting whatever model you had previously setup, not the newly configured claude token. I don't believe that adding the provider by the script, in and of itself, re-assigns it as the main model to be used, which invalidates the test steps.

[LazerLance777]

@dnvnmr793 Good catch on the test methodology. You're right that if you still have an API key configured, openclaw agent --message could be using that instead of the setup-token — making the test pass for the wrong reason.

To verify the fix is actually using the setup-token path:

1. Remove any API key from your auth profiles:

   cat ~/.openclaw/agents/main/agent/auth-profiles.json

   Make sure the only profile is type "token" with an sk-ant-oat01-* key. No sk-ant-api03-* entries.

2. Verify the patch applied — the (external, cli) string should be gone:

   grep "(external, cli)" "$(npm root -g)/openclaw/node_modules/@mariozechner/pi-ai/dist/providers/anthropic.js"

   If this returns nothing, the patch applied. If it returns a match, it didn't.

3. Restart the gateway after patching:

   openclaw gateway restart --force

4. Then test:

   openclaw agent --agent main --message "hello"

On my end, I tested with setup-token as the only auth method (no API key fallback) and confirmed it works with both anthropic/claude-sonnet-4-5 and anthropic/claude-opus-4-6. The grep verification in step 2 is the key check — if the string is still there, the sed didn't match (which could happen if your compiled JS has different formatting).

[flowline905]

I stripped everything out of my auth profiles relating to anthropic, and rebuilt from scratch after applying your patch - and it seems to be working!

[syntec11]

I'm still having issues.
I did what you suggested (I think) @dnvnmr793 - but perhaps not in the right order?
Here's my steps:

• Ran the fix, pasted in a new manual token
• Deleted out all other anthropic API references
• Confirmed there was only the "manual" option with my new token
• ran the verification checks above
• restarted gateway

But still get the bearer token problem.
Can you let me know what you did differently? Did you pull all the anthropic entries out of the json, then ran the fix and updated the token? Or something else?