Description

Claude models fail to authenticate when using OAuth bearer tokens, resulting in HTTP 401 errors and causing all Anthropic models to enter cooldown, leading to complete fallback chain failure.

Problem

After configuring Anthropic authentication using OAuth tokens (via setup-token flow), attempts to use Claude models consistently fail with authentication errors. Once a token failure occurs, the entire provider enters cooldown mode, preventing any subsequent requests until manual intervention.

Error Message

HTTP 401 authentication_error: Invalid bearer token

Followed by:

No available auth profile for anthropic (all in cooldown or unavailable)

Impact

• Critical: All Anthropic/Claude models become completely unavailable
• Complete fallback chain failure when Anthropic is the primary or only provider
• No automatic recovery - requires manual intervention
• Poor user experience with no clear resolution path
• Affects all Claude model variants (Opus, Sonnet, Haiku)

Environment

• OpenClaw Version: 2026.2.2-3
• Platform: macOS
• Authentication Method: OAuth bearer token (setup-token flow)
• Affected Models: All Anthropic Claude models

Reproduction Steps

1. Configure Anthropic provider using OAuth token:

   openclaw providers setup anthropic --auth-method setup-token

2. Paste OAuth bearer token when prompted

3. Attempt to use any Claude model through OpenClaw:

   openclaw chat "Hello" --model claude-opus-4-5

4. Observe HTTP 401 authentication error

5. Attempt subsequent requests

6. Observe "all in cooldown" error preventing any Anthropic model usage

Expected Behavior

1. Valid token: OAuth token should authenticate successfully
2. Token refresh: If token expires, OpenClaw should automatically refresh it
3. Clear errors: If token is invalid, provide clear actionable error message
4. Graceful degradation: Single auth failure shouldn't put entire provider in permanent cooldown
5. Recovery: Automatic retry with token refresh, or clear instructions for manual token update

Actual Behavior

1. OAuth token immediately fails with 401 error
2. No automatic token refresh attempted
3. All Anthropic auth profiles enter cooldown
4. Provider becomes completely unavailable
5. No automatic recovery mechanism
6. No clear guidance on resolution

Error Pattern Timeline

[Initial Request]
-> HTTP 401: Invalid bearer token

[Subsequent Requests]
-> No available auth profile for anthropic (all in cooldown or unavailable)

[Continues indefinitely until manual intervention]

Additional Context

• This may be related to OAuth token format or expiration handling
• Token might be valid but malformed in request headers
• Refresh token mechanism may not be implemented
• Cooldown period may be too aggressive for auth failures
• No distinction between temporary auth failures and permanent token invalidity

Suggested Fix

1. Token validation: Validate OAuth token format before use
2. Refresh mechanism: Implement automatic OAuth token refresh using refresh tokens
3. Retry logic: Distinguish between expired tokens (retry with refresh) vs invalid tokens (prompt user)
4. Cooldown adjustment: Don't apply cooldown for auth errors that can be resolved
5. Error messages: Provide specific guidance:
   • "OAuth token expired. Attempting refresh..."
   • "OAuth token invalid. Please reconfigure: openclaw providers setup anthropic"
6. Health check: Add endpoint to validate token status before actual API calls
7. Logging: Add debug logs showing token validation and refresh attempts

Workaround

Currently, users must:

1. Stop the OpenClaw gateway
2. Reconfigure Anthropic provider with new token
3. Restart gateway
4. Hope the new token works

This is not sustainable for production use.

Labels

bug, authentication, anthropic, oauth, priority:critical