fix: allow device-paired clients to retrieve TTS API keys by akramcodez · Pull Request #14613 · openclaw/openclaw

akramcodez · 2026-02-12T11:38:50Z

Problem

iOS/macOS talk mode fails because ElevenLabs API key is always redacted in config.get RPC responses. The iOS app receives __OPENCLAW_REDACTED__ instead of the actual API key, causing 401 errors from ElevenLabs.

Solution

Added optional includeSecrets parameter to config.get RPC with proper authorization:

iOS app passes includeSecrets: true when requesting config
Server only returns unredacted secrets to device-paired clients (verified via deviceToken)
Unauthorized clients always receive redacted config (backward compatible)

Security

Authorization check via client.deviceToken - only paired devices get secrets
Default behavior unchanged - still redacts by default
Explicit opt-in required via includeSecrets: true

Testing

TypeScript compilation passes (tsc --noEmit)
Unpaired clients still receive redacted config (verified via redact-snapshot.test.ts)
Backward compatibility maintained (no regression in existing config responses)

Changes

Added includeSecrets optional param to ConfigGetParamsSchema
Added deviceToken to GatewayClient and GatewayWsClient types
Plumbed deviceToken through WebSocket handshake
Conditional redaction based on authorization in config.get handler
iOS app requests unredacted config for TTS

fixes #14586

Greptile Overview

Greptile Summary

This PR adds an includeSecrets?: boolean option to the config.get RPC and plumbs the device-pairing token into the per-connection client object so config.get can return either a redacted snapshot (default) or the full on-disk snapshot for device-paired clients. The iOS TalkModeManager now opts in with includeSecrets: true when reloading talk-mode configuration.

The change fits into the gateway’s existing redaction system (redactConfigSnapshot) by keeping redaction as the default and only bypassing it when an authenticated/paired device is detected via the WebSocket handshake state.

Confidence Score: 2/5

Not safe to merge as-is; the main functional path appears blocked by existing gateway authorization rules.
The includeSecrets behavior is implemented, but config.get remains gated behind operator.admin for all clients, which likely prevents device-paired mobile clients from accessing it and makes the intended fix ineffective. No other definite regressions were found in the changed files.
src/gateway/server-methods.ts, src/gateway/server-methods/config.ts

greptile-apps

_{6 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-12T11:52:08Z

Additional Comments (1)

src/gateway/server-methods.ts
Admin scope blocks fix

authorizeGatewayMethod currently denies all config.* methods unless the client has operator.admin (src/gateway/server-methods.ts:141-163). This PR’s new includeSecrets && client.deviceToken path in config.get (src/gateway/server-methods/config.ts:95-114) won’t be reachable for device-paired clients unless they also request/are granted operator.admin, so iOS talk mode may still receive a denied RPC rather than an unredacted key.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/gateway/server-methods.ts
Line: 141:163

Comment:
**Admin scope blocks fix**

`authorizeGatewayMethod` currently denies *all* `config.*` methods unless the client has `operator.admin` (`src/gateway/server-methods.ts:141-163`). This PR’s new `includeSecrets && client.deviceToken` path in `config.get` (`src/gateway/server-methods/config.ts:95-114`) won’t be reachable for device-paired clients unless they also request/are granted `operator.admin`, so iOS talk mode may still receive a denied RPC rather than an unredacted key.

How can I resolve this? If you propose a fix, please make it concise.

akramcodez · 2026-02-12T11:56:47Z

Hi @gumadeiras @thewilloftheshadow @cpojer,

Would appreciate a review when you get a chance. This refactors gateway authorization by adding config.get to the READ_METHODS set, allowing device-paired clients to access it without requiring operator.admin.

This unblocks the includeSecrets flow for TTS on iOS while keeping default redaction and existing security guarantees intact.

Thanks!

oswalpalash · 2026-02-12T13:09:53Z

possibly duplicates #14645

steipete · 2026-02-13T16:08:16Z

Landed via temp rebase onto main.

Gate: pnpm check (blocked by existing unrelated lint in src/plugins/discovery.test.ts and src/infra/provider-usage.auth.normalizes-keys.test.ts), pnpm exec vitest run --config vitest.e2e.config.ts src/gateway/server.talk-config.e2e.test.ts src/gateway/server.auth.e2e.test.ts
Land commit: cfd03eb
Merge commit: 4c86821

Thanks @akramcodez!

…4613) * refactor: add config.get to READ_METHODS set * refactor(gateway): scope talk secrets via talk.config * fix: resolve rebase conflicts for talk scope refactor --------- Co-authored-by: Peter Steinberger <steipete@gmail.com>

…4613) * refactor: add config.get to READ_METHODS set * refactor(gateway): scope talk secrets via talk.config * fix: resolve rebase conflicts for talk scope refactor --------- Co-authored-by: Peter Steinberger <steipete@gmail.com> (cherry picked from commit 4c86821) # Conflicts: # apps/android/app/src/main/java/ai/openclaw/android/node/ConnectionManager.kt

…4613) * refactor: add config.get to READ_METHODS set * refactor(gateway): scope talk secrets via talk.config * fix: resolve rebase conflicts for talk scope refactor --------- Co-authored-by: Peter Steinberger <steipete@gmail.com> (cherry picked from commit 4c86821) # Conflicts: # apps/android/app/src/main/java/ai/openclaw/android/node/ConnectionManager.kt # apps/ios/Sources/Model/NodeAppModel.swift # src/gateway/server-methods/talk.ts

…4613) * refactor: add config.get to READ_METHODS set * refactor(gateway): scope talk secrets via talk.config * fix: resolve rebase conflicts for talk scope refactor --------- Co-authored-by: Peter Steinberger <steipete@gmail.com>

openclaw-barnacle Bot added app: ios App: ios app: web-ui App: web-ui gateway Gateway runtime size: XS labels Feb 12, 2026

greptile-apps Bot reviewed Feb 12, 2026

View reviewed changes

steipete self-assigned this Feb 13, 2026

akramcodez and others added 3 commits February 13, 2026 17:02

refactor: add config.get to READ_METHODS set

dfbb81a

refactor(gateway): scope talk secrets via talk.config

496fd50

fix: resolve rebase conflicts for talk scope refactor

cfd03eb

steipete force-pushed the fix/tts-api-key-authorized-access branch from e16eb04 to cfd03eb Compare February 13, 2026 16:07

steipete merged commit 4c86821 into openclaw:main Feb 13, 2026
9 checks passed

openclaw-barnacle Bot added app: android App: android app: macos App: macos size: M trusted-contributor and removed size: XS labels Feb 13, 2026

github-actions Bot mentioned this pull request Feb 13, 2026

📡 Upstream Digest — 2026-02-13 16:36 UTC curtismercier/openclaw-mods#15

Open

nickytonline mentioned this pull request Feb 14, 2026

nickytonline/trusted auth docs update nickytonline/openclaw#1

Closed

github-actions Bot mentioned this pull request Mar 1, 2026

cherry-pick: upstream bugfix commits (2026-03-01-0443) hughdidit/DAISy-Agency#140

Closed

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: allow device-paired clients to retrieve TTS API keys#14613

fix: allow device-paired clients to retrieve TTS API keys#14613
steipete merged 3 commits into
openclaw:mainfrom
akramcodez:fix/tts-api-key-authorized-access

akramcodez commented Feb 12, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

greptile-apps Bot left a comment

Uh oh!

greptile-apps Bot commented Feb 12, 2026

Uh oh!

akramcodez commented Feb 12, 2026

Uh oh!

oswalpalash commented Feb 12, 2026

Uh oh!

Uh oh!

steipete commented Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

akramcodez commented Feb 12, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Security

Testing

Changes

Greptile Overview

Greptile Summary

Confidence Score: 2/5

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Feb 12, 2026

Uh oh!

akramcodez commented Feb 12, 2026

Uh oh!

oswalpalash commented Feb 12, 2026

Uh oh!

Uh oh!

steipete commented Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

akramcodez commented Feb 12, 2026 •

edited by greptile-apps Bot

Loading