Summary

Include SecretRef support for openclaw.json env block to allow a workflow where secrets stored as environment variables can be resolved at runtime (e.g. from 1Password)

Problem to solve

Currently, secretRef is not supported for the env block in openclaw.json. This makes setting/passing environment variables where the value is not static but rather derived dynamically (e.g. from 1Password) difficult.

Proposed solution

Extend SectrerRef support for the env block, similar to API keys:

  "secrets": {
    "providers": {
      "default": { "source": "env" },
      "op-my-sectet": {
        "source": "exec",
        "command": "/usr/bin/op",
        "allowInsecurePath": true,
        "args": ["read", "--no-newline", "op://MyVault/MySecret/credential"],
        "passEnv": ["HOME", "OP_SERVICE_ACCOUNT_TOKEN"],
        "jsonOnly": false
      },
  "env": {
    "vars": {
      "MY_SECRET_VAR": { "source": "exec", "provider": "op-my-secret", "id": "value" }
    }

Alternatives considered

Alternative is to define environment variables in .env as static values but that is counterproductive to having all secrets stored in an external values like 1Password. One can then have Gateway and Model tokens/passwords in 1Password but then still have to keep other secrets (e.g. ones used by Skills requiring environment vars) on the filesystem.

Impact

Someone wishing to offload all secret storage to an external secret management system for a better security posture.

Example: https://prokopov.me/posts/securing-openclaw-with-1password/

Evidence/examples

No response

Additional information

No response