fix(openai): require api-key auth for realtime voice by joshavant · Pull Request #91567 · openclaw/openclaw

joshavant · 2026-06-09T02:43:49Z

Summary

Require OpenAI Realtime voice to use OpenAI Platform API-key credentials instead of OpenAI OAuth bearer tokens.
Preserve valid API-key auth-profile users by adding provider-auth profile type filtering and using openai api_key profiles for Realtime voice.
Update OpenAI and Control UI Talk docs to distinguish OpenAI API-key profiles from OAuth profiles for Realtime voice.

Compatibility note

Existing OpenAI OAuth-only Talk/Realtime setups will now show OpenAI Realtime voice as unconfigured until an OpenAI Platform API key, OPENAI_API_KEY, or an openai API-key auth profile is configured. OAuth profiles still work for Codex-backed openai/* chat models, but they no longer satisfy Realtime voice configuration.

Verification

.agents/skills/autoreview/scripts/autoreview --mode local clean: no accepted/actionable findings.
pnpm test extensions/openai/realtime-voice-provider.test.ts src/plugin-sdk/provider-auth.test.ts -- --reporter=verbose
git diff --check
AWS Crabbox E2E OAuth-only Gateway Talk repro: provider aws, lease cbx_db09d2a9c1af, run run_0b7d65c055d2, exit 0, lease stopped. The isolated OAuth-only OpenAI auth profile produced catalogOpenAI.configured=false, talk.client.create failed with UNAVAILABLE, and no WebRTC session was returned.

Real behavior proof

Behavior addressed: OAuth-only OpenAI Realtime voice no longer advertises as configured or returns a browser WebRTC session that later fails at OpenAI /v1/realtime/calls.

Real environment tested: AWS Crabbox Linux (provider=aws, lease=cbx_db09d2a9c1af, run=run_0b7d65c055d2).

Exact steps or command run after this patch: Started an isolated OpenClaw Gateway with talk.realtime.provider: "openai", transport: "webrtc", no OPENAI_API_KEY, and only an openai OAuth auth profile; connected through Gateway WebSocket RPC; called talk.catalog and talk.client.create.

Evidence after fix: ISSUE_90456_CRABBOX_PROOF={"catalogOpenAI":{"configured":false,"supportsBrowserSession":true,"transports":["webrtc","gateway-relay"]},"createOk":false,"createReturnedWebrtcSession":false,"createError":{"name":"GatewayClientRequestError","message":"Error: Realtime voice provider \"openai\" is not configured","gatewayCode":"UNAVAILABLE"},"reproducedFixedBehavior":true}.

Observed result after fix: OpenAI Realtime voice remains discoverable but not configured for OAuth-only auth, and talk.client.create fails before minting or returning a browser session.

What was not tested: A live paid OpenAI Platform API-key WebRTC media exchange was not rerun in this PR; focused tests cover explicit API key, OPENAI_API_KEY, keychain env refs, and openai API-key auth profile resolution.

clawsweeper · 2026-06-09T02:51:07Z

Codex review: needs maintainer review before merge. Reviewed June 8, 2026, 11:03 PM ET / 03:03 UTC.

Summary
Requires OpenAI Realtime voice to resolve OpenAI Platform API-key credentials, filters provider auth profiles by credential type, and updates the related docs and tests.

PR surface: Source -59, Tests +45, Docs -2. Total -16 across 6 files.

Reproducibility: yes. the linked issue gives a concrete v2026.6.1 live repro, and current source inspection shows OAuth profiles can satisfy the Realtime configured/auth path before this PR, though I did not rerun the live handshake locally.

Review metrics: 1 noteworthy metric.

OpenAI Realtime auth fallback: 1 shipped fallback removed/changed. The PR changes OAuth-only OpenAI Realtime from configured-at-runtime to fail-closed, which is the key upgrade behavior maintainers must accept before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Maintainer should explicitly accept the OAuth-only Realtime compatibility break before merge.

Risk before merge

[P1] Existing OpenAI OAuth-only Realtime voice users who saw the provider as configured in v2026.6.1 will now see it unconfigured and must add an OpenAI Platform API-key auth profile, config value, or OPENAI_API_KEY.
[P1] The provider-auth SDK change is additive, but it still touches public plugin auth helper behavior and should remain a deliberate maintainer-owned compatibility decision.

Maintainer options:

Accept API-key-only Realtime voice (recommended)
Land as-is after maintainer confirms OAuth-only OpenAI Realtime should fail closed and users must configure OpenAI Platform API-key auth.
Require an upgrade note
Before merge, add explicit release-note or PR-body wording that OAuth-only OpenAI users will see Realtime unconfigured until they configure API-key auth.

Next step before merge

[P2] Protected maintainer review and the intentional shipped auth fallback removal need human acceptance, not an automated repair.

Security
Cleared: The diff narrows credential use for OpenAI Realtime voice and does not change CI, dependencies, lockfiles, publishing, or secret exposure paths.

Review details

Best possible solution:

Land the API-key-only Realtime voice path after maintainer accepts the shipped OAuth fallback removal and release-note context calls out the API-key auth requirement.

Do we have a high-confidence way to reproduce the issue?

Yes: the linked issue gives a concrete v2026.6.1 live repro, and current source inspection shows OAuth profiles can satisfy the Realtime configured/auth path before this PR, though I did not rerun the live handshake locally.

Is this the best way to solve the issue?

Yes: the OpenAI Realtime WebRTC dependency contract and failing user path point to requiring Platform API-key credentials for Realtime voice, and the patch preserves explicit config, env, and API-key auth profiles while removing the unsupported OAuth path. (developers.openai.com)

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 0933726574e8.

Label changes

Label changes:

add P1: The PR fixes a broken OpenAI Realtime Talk workflow that currently advertises as configured but fails live media setup for OAuth-only users.
add merge-risk: 🚨 compatibility: Merging changes shipped v2026.6.1 behavior for existing OAuth-only OpenAI Realtime configurations and requires users to add API-key auth.
add merge-risk: 🚨 auth-provider: The diff changes provider auth profile selection and Realtime credential routing for the OpenAI provider.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR includes after-fix AWS Crabbox Gateway proof for the OAuth-only failure mode, showing configured=false, UNAVAILABLE, and no returned WebRTC session; positive paid API-key media exchange was not rerun but is covered by focused credential-resolution tests.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (logs): The PR includes after-fix AWS Crabbox Gateway proof for the OAuth-only failure mode, showing configured=false, UNAVAILABLE, and no returned WebRTC session; positive paid API-key media exchange was not rerun but is covered by focused credential-resolution tests.

Label justifications:

P1: The PR fixes a broken OpenAI Realtime Talk workflow that currently advertises as configured but fails live media setup for OAuth-only users.
merge-risk: 🚨 compatibility: Merging changes shipped v2026.6.1 behavior for existing OAuth-only OpenAI Realtime configurations and requires users to add API-key auth.
merge-risk: 🚨 auth-provider: The diff changes provider auth profile selection and Realtime credential routing for the OpenAI provider.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (logs): The PR includes after-fix AWS Crabbox Gateway proof for the OAuth-only failure mode, showing configured=false, UNAVAILABLE, and no returned WebRTC session; positive paid API-key media exchange was not rerun but is covered by focused credential-resolution tests.
proof: sufficient: Contributor real behavior proof is sufficient. The PR includes after-fix AWS Crabbox Gateway proof for the OAuth-only failure mode, showing configured=false, UNAVAILABLE, and no returned WebRTC session; positive paid API-key media exchange was not rerun but is covered by focused credential-resolution tests.

Evidence reviewed

PR surface:

Source -59, Tests +45, Docs -2. Total -16 across 6 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	82	141	-59
Tests	2	157	112	+45
Docs	2	17	19	-2
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	6	256	272	-16

Acceptance criteria:

[P1] Review the PR's Crabbox proof for the OAuth-only fail-closed path.
[P1] Confirm release-note or merge note covers API-key auth requirement for existing OAuth-only users.
[P1] Run or rely on the provided focused tests for OpenAI realtime voice and provider-auth profile filtering.

What I checked:

Policy read: The root and scoped repository guidance were applied; plugin SDK/auth surfaces and shipped fallback changes are compatibility-sensitive and protected by maintainer review policy. (AGENTS.md:1, 0933726574e8)
PR source behavior: On the PR head, OpenAI Realtime resolves a configured API key, an openai auth profile filtered to api_key, or OPENAI_API_KEY; OAuth profiles are excluded from Realtime voice API-key resolution. (extensions/openai/realtime-voice-provider.ts:339, 50dec30a98e9)
PR browser session behavior: The browser WebRTC session path on the PR head calls the Platform API-key resolver before minting a Realtime client secret, so OAuth-only installs fail before returning browser session metadata. (extensions/openai/realtime-voice-provider.ts:1294, 50dec30a98e9)
Additive SDK filtering: The provider-auth helper adds an optional profileTypes filter and applies it before resolving an auth profile API key, preserving existing callers that omit the option. (src/plugin-sdk/provider-auth.ts:407, 50dec30a98e9)
Regression tests: PR tests cover OAuth/no-key bridge failure before fetch/WebSocket, API-key profile resolution, browser-session no-key failure, browser-session API-key profile minting, and OPENAI_API_KEY resolution. (extensions/openai/realtime-voice-provider.test.ts:283, 50dec30a98e9)
Provider-auth test: The added provider-auth test demonstrates that an OAuth auth profile is skipped when profileTypes: ["api_key"] is requested and only the API-key profile is resolved. (src/plugin-sdk/provider-auth.test.ts:104, 50dec30a98e9)

Likely related people:

Peter Steinberger: History sampling shows the largest share of commits across the OpenAI realtime provider, provider-auth helper, and related docs, including prior realtime helper refactors. (role: feature-history owner; confidence: high; commits: 6dfdc92bd4c6, a5b563280910; files: extensions/openai/realtime-voice-provider.ts, docs/providers/openai.md)
Vincent Koc: Recent current-main and auth-routing commits touch the relevant provider-auth and OpenAI realtime behavior, including the shipped v2026.6.1 baseline path. (role: recent area contributor; confidence: high; commits: 2e08f0f4221f, 859eb0666282; files: extensions/openai/realtime-voice-provider.ts, src/plugin-sdk/provider-auth.ts)
joshavant: Beyond authoring this PR, prior merged work touched adjacent Control UI/config and docs surfaces relevant to auth/config handling. (role: recent adjacent contributor; confidence: medium; commits: 81b777c768; files: docs/web/control-ui.md)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

* fix(openai): require api-key auth for realtime voice * test(plugin-sdk): avoid auth profile store shadowing

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix(openai): require api-key auth for realtime voice

e8df937

openclaw-barnacle Bot added docs Improvements or additions to documentation extensions: openai size: M maintainer Maintainer-authored PR labels Jun 9, 2026

test(plugin-sdk): avoid auth profile store shadowing

50dec30

joshavant merged commit 9fdd56d into main Jun 9, 2026
322 of 336 checks passed

joshavant deleted the fix/openai-realtime-api-key-auth branch June 9, 2026 03:55

joshavant mentioned this pull request Jun 9, 2026

[Bug]: OpenAI OAuth Realtime Talk sessions fail /v1/realtime/calls with HTTP 500 #90456

Closed

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 9, 2026

fix(openai): require api-key auth for realtime voice (openclaw#91567)

4b03354

* fix(openai): require api-key auth for realtime voice * test(plugin-sdk): avoid auth profile store shadowing

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 07:39 UTC curtismercier/openclaw-mods#1043

Open

clawsweeper Bot mentioned this pull request Jun 9, 2026

fix(logging): resolve app-agent diagnostic transcripts #91600

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(openai): require api-key auth for realtime voice#91567

fix(openai): require api-key auth for realtime voice#91567
joshavant merged 2 commits into
mainfrom
fix/openai-realtime-api-key-auth

joshavant commented Jun 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

joshavant commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Compatibility note

Verification

Real behavior proof

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

joshavant commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading