Problem

TTS has its own credential resolution (resolveTtsApiKey in src/tts/tts.ts) that completely bypasses the auth profile store. This means:

• OpenAI API key in auth profiles (openai:default) is invisible to TTS
• ElevenLabs keys must be configured separately in messages.tts.elevenlabs.apiKey or ELEVENLABS_API_KEY
• No key rotation support for TTS providers
• Onboarding doesn't know TTS needs its own credential path

This is an upstream design gap — verified identical in OpenClaw (openclaw/main). Never fixed.

Current resolution (TTS)

// src/tts/tts.ts — resolveTtsApiKey (SYNC)
export function resolveTtsApiKey(
  config: ResolvedTtsConfig,
  provider: TtsProvider,
): string | undefined {
  if (provider === "elevenlabs") {
    return config.elevenlabs.apiKey || process.env.ELEVENLABS_API_KEY || process.env.XI_API_KEY;
  }
  if (provider === "openai") {
    return config.openai.apiKey || process.env.OPENAI_API_KEY;
  }
}

Current resolution (auth profiles)

// src/auth/provider-auth.ts
// resolveApiKeyForProvider: profile store → env var fallback (ASYNC)
// Already handles "openai" → OPENAI_API_KEY, "deepgram" → DEEPGRAM_API_KEY

Proposed fix

resolveTtsApiKey should use resolveApiKeyForProvider from src/auth/provider-auth.ts as the first check, before config and env vars. This is a direct import — no DI wrapper needed (STT and media-understanding already import auth profiles directly).

Resolution order (new)

resolveApiKeyForProvider (auth profile store → env var fallback)
  → Config fallback (messages.tts.{provider}.apiKey) — backwards compat only

Note: resolveApiKeyForProvider already includes env var fallback internally, so the config-embedded apiKey fields become a tertiary backwards-compat fallback only.

Implementation

import { resolveApiKeyForProvider } from "../auth/provider-auth.js";

export async function resolveTtsApiKey(
  config: ResolvedTtsConfig,
  provider: TtsProvider,
): Promise<string | undefined> {
  // Skip auth lookup for providers that don't need API keys
  if (provider === "edge") return undefined;

  // 1. Auth profile store (unified credential system)
  try {
    const auth = await resolveApiKeyForProvider({
      provider: ttsProviderToAuthProvider(provider),
    });
    if (auth.apiKey) return auth.apiKey;
  } catch {
    // no profile found — fall through
  }

  // 2. Config fallback (backwards compat)
  if (provider === "elevenlabs") {
    return config.elevenlabs.apiKey || undefined;
  }
  if (provider === "openai") {
    return config.openai.apiKey || undefined;
  }
  return undefined;
}

function ttsProviderToAuthProvider(provider: TtsProvider): string {
  // Direct 1:1 mapping — no translation needed today
  return provider;
}

Sync → async impact

resolveTtsApiKey becomes async because resolveApiKeyForProvider is async (profile store I/O). This impacts 8 call sites across 3 files, including 2 currently-sync functions that must become async:

Provider mapping

Backwards compatibility

Fully backwards-compatible:

1. If auth profiles have a matching key → use it (new behavior, better)
2. If not → fall back to existing config resolution (unchanged behavior)

Depends on

• feat(auth): add ElevenLabs provider to auth profile system #403 — ElevenLabs auth provider (for elevenlabs support)

Related

• feat: unified auth + multimodal AgentRuntime — implementation plan #415 — implementation plan (Phase 6)
• research(auth+media): auth profiles and media understanding architecture #376 — auth/media research (predecessor)
• Upstream candidate: yes (adjust import path to src/agents/provider-auth.ts for OpenClaw)