Bug Report

Version: OpenClaw 2026.3.26 (f9b8499)

Description

After upgrading to 2026.3.26, the openai-codex provider always fails with:

No API key for provider: openai-codex

This affects all openai-codex/* models (tested with gpt-5.4 and gpt-5.3-codex). The gateway falls back to the configured fallback model (e.g. anthropic/claude-opus-4-6).

Root Cause

The OAuth token is resolved correctly from auth-profiles.json and stored via authStorage.setRuntimeApiKey(model.provider, apiKeyInfo.apiKey). However, pi-ai's streamSimpleOpenAICodexResponses does not read from AuthStorage — it checks options?.apiKey || getEnvApiKey(model.provider):

// In @mariozechner/pi-ai/dist/providers/openai-codex-responses.js
const streamSimpleOpenAICodexResponses = (model, context, options) => {
    const apiKey = options?.apiKey || getEnvApiKey(model.provider);
    if (!apiKey) {
        throw new Error(`No API key for provider: ${model.provider}`);
    }
    // ...
};

getEnvApiKey() has no mapping for openai-codex (there is no OPENAI_CODEX_API_KEY env var entry), and options.apiKey is not being populated by OpenClaw's caller.

Meanwhile, the non-Simple streamOpenAICodexResponses function does its own getEnvApiKey(model.provider) check separately, which also fails.

Call Chain

1. getApiKeyForModel() → resolveApiKeyForProvider() → resolves OAuth access token from auth-profiles.json ✅
2. authStorage.setRuntimeApiKey(model.provider, apiKeyInfo.apiKey) — stores in AuthStorage object ✅
3. Pi-ai's streamSimpleOpenAICodexResponses checks options?.apiKey — empty ❌
4. Falls through to getEnvApiKey("openai-codex") — no mapping ❌
5. Throws No API key for provider: openai-codex

Key Files

• pi-model-discovery-DaNAekda.js: discoverAuthStorage() creates AuthStorage from auth.json (legacy path)
• model-auth-CxlTW8uU.js: resolveApiKeyForProvider() reads from auth-profiles.json correctly
• pi-embedded-_crSbDV9.js: Line ~68870 calls authStorage.setRuntimeApiKey() but the token never reaches the Simple stream function's options.apiKey

Expected Behavior

The resolved OAuth access token should be passed as options.apiKey when calling streamSimpleOpenAICodexResponses, or pi-ai's getEnvApiKey should include a mapping for openai-codex.

Workaround

None clean. Setting OPENAI_CODEX_API_KEY env var works temporarily but OAuth tokens expire.

Environment

• OpenClaw 2026.3.26 (f9b8499)
• macOS (arm64)
• Auth profile: openai-codex:sylvia@email.me (type: oauth, valid access token)
• Models tested: openai-codex/gpt-5.4, openai-codex/gpt-5.3-codex