Description

Running openclaw doctor --fix or openclaw doctor --repair removes custom API keys from the secrets section of openclaw.json.

Steps to Reproduce

1. Add custom API keys directly under the secrets section:

   "secrets": {
     "brave_news_api_key": "BSACsc...",
     "football_data_api_key": "ac6b2a...",
     "alpha_vantage_api_key": "J22HYYG..."
   }

2. Run openclaw doctor --fix or openclaw doctor --repair
3. Check openclaw.json - the secrets section is now empty: "secrets": {}

Expected Behavior

Custom API keys stored directly under secrets should be preserved during doctor runs.

Root Cause

The SecretsConfigSchema in auth-profiles-CNyDTsy4.js uses .strict() validation which only allows 3 specific keys:

• providers
• defaults
• resolution

When doctor runs with --fix/--repair, it calls stripUnknownConfigKeys() which uses Zod's strict validation. Custom keys like brave_news_api_key are treated as "unrecognized keys" and deleted.

Suggested Fix

Change SecretsConfigSchema from .strict() to .catchall(z.string()) to allow arbitrary key-value pairs.

Environment

• OpenClaw version: 2026.3.2
• Node version: v22.22.0
• OS: Linux (Raspberry Pi)

Workaround

Run openclaw doctor without --fix or --repair flags to avoid key deletion.