Problem

The auth profile system knows about model API providers (OpenAI, Anthropic, Google, Deepgram, etc.) but does not know about ElevenLabs. This means:

• No elevenlabs:default profile can be created during onboarding
• No key rotation for ElevenLabs
• TTS ElevenLabs keys live in a separate config silo (messages.tts.elevenlabs.apiKey)

Proposed changes

1. Add ElevenLabs to env var resolution

In src/auth/provider-auth.ts, add ElevenLabs as a special-case handler in resolveEnvApiKey (before the generic envMap) to support the legacy XI_API_KEY fallback:

if (normalized === "elevenlabs") {
  return pick("ELEVENLABS_API_KEY") ?? pick("XI_API_KEY");
}

2. Add ElevenLabs to env injection mapping

In src/auth/env-injection.ts, add to resolveProviderEnvVarName:

const envMap: Record<string, string> = {
  // ... existing entries
  elevenlabs: "ELEVENLABS_API_KEY",  // ← add
};

Without this, auth profile → CLI env var injection won't work for ElevenLabs.

3. Onboarding support

Add ElevenLabs credential setter and CLI flag:

src/commands/onboard-auth.credentials.ts — add setter:

export async function setElevenLabsApiKey(key: string) {
  upsertAuthProfile({
    profileId: "elevenlabs:default",
    credential: {
      type: "api_key",
      provider: "elevenlabs",
      key,
    },
  });
}

src/commands/onboard-provider-auth-flags.ts — add flag entry for --elevenlabs-api-key.

When TTS is configured with provider: "elevenlabs", the onboarding flow should:

• Prompt for ElevenLabs API key
• Store as elevenlabs:default in auth profiles
• Remove the need for messages.tts.elevenlabs.apiKey config field

4. Profile ID format

Following existing conventions:

• elevenlabs:default — primary ElevenLabs API key
• elevenlabs:{label} — additional keys for rotation

Files to change

Notes

• Auth profile types use open provider: string — no type changes needed
• normalizeProviderId("elevenlabs") returns "elevenlabs" directly — no normalization rule needed
• listProfilesForProvider() works automatically for any provider string

Upstream compatibility

This change is designed to be submittable upstream to OpenClaw:

• Additive only — no existing behavior changes
• Follows established provider patterns (same as deepgram, openai, etc.)
• ElevenLabs is already used by upstream OpenClaw's TTS module

Depends on

• Should land alongside or before fix(tts): resolve TTS API keys through auth profile store #402 (TTS auth profile integration)

Related

• feat: unified auth + multimodal AgentRuntime — implementation plan #415 — implementation plan (Phase 6)
• research(auth+media): auth profiles and media understanding architecture #376 — auth/media restructuring (predecessor)
• Upstream candidate: yes