Bug type

Behavior bug (incorrect output/state without crash)

Summary

When using sessionTarget: isolated cron jobs with a custom model provider (e.g. a company-internal LLM proxy), the isolated agent silently fails with No API key found for provider "<custom-provider>" — with no actionable setup path.

The root issue is a combination of three problems:

1. auth-profiles.json format for custom providers is undocumented. The type field accepts "oauth" or "token", but this is not documented anywhere. Trial-and-error through "api_key", "bearer", "static", etc. all fail with invalid_type — no error message indicates what values are valid.

2. openclaw models auth paste-token requires an interactive TTY. It cannot be scripted or used non-interactively, making it impossible to configure auth programmatically or via automation.

3. The isolated agent gives no setup guidance. The error message says "Configure auth for this agent (openclaw agents add ) or copy auth-profiles.json from the main agentDir" — but openclaw agents add does not have a subcommand for adding auth to an existing agent, and copying the file does not help if the format is wrong.

Steps to reproduce

1. Configure a cron job with sessionTarget: isolated and a custom provider (e.g. my-proxy/gpt-4) in models.json
2. Trigger the cron job
3. Observe: FallbackSummaryError: All models failed: No API key found for provider "my-proxy"
4. Try to fix: openclaw models auth paste-token --provider my-proxy → requires TTY, fails in automation
5. Try to fix manually: add entry to auth-profiles.json with type: "api_key" → invalid_type error, no hint on valid values
6. The only working format (type: "token", field name token not key) must be discovered by reading minified source code

Expected behavior

• The paste-token command should work non-interactively via --token flag or stdin
• Valid type values should be documented or listed in the error message
• auth-profiles.json schema should be documented in the official docs

Environment

• OpenClaw version: 2026.4.5
• macOS 26.4

Additional context

The type: "token" format with field token (not key) was discovered by reading profiles-DKQdaSwr.js:

type === "token" ? { ...credential, token: normalizeSecretInput(credential.token) }

This should not be necessary.

🤖 Generated with Claude Code