OpenClaw: Gateway token or provider API key?

A Gateway token connects your app to OpenClaw. A provider API key lets OpenClaw call a model. Locate the failed connection before changing either credential. A reachable dashboard alone does not prove that its WebSocket authenticated or that a model request succeeded.

Gateway token missing: check the app-to-Gateway connection

A WebSocket connection log naming token_missing and authProvided=none points to the Gateway handshake. Check which Gateway URL, profile and connection mode the failing app uses, and which authentication method that Gateway expects. Its connection credential belongs in that client’s Gateway settings; a model provider key does not replace it.

Record the app and Gateway versions and the exact failing client. In public issue #166707, a reporter using macOS app 2026.9.8 describes missing credentials on local UI/node connections while a separately configured Control UI connects. This is a reported case, not proof that every token_missing has that bug. Repeatedly rotating a provider key cannot diagnose this handshake.

pairing required and device identity required name additional device checks. Follow the Gateway troubleshooting reference for the exact signature; do not disable authentication or delete pairing state to make a red indicator disappear.

No API key found for provider: check credential resolution

This message names the model-provider layer. First establish whether OpenClaw actually sent an HTTP request. A local credential-resolution error is different from an upstream server returning 401.

1. Identify the selected agent, provider ID and model. Check the credential reference available to the machine and process running the Gateway, including a service environment that may differ from your terminal.
2. Check the effective provider config. Agent-level models.json can affect baseUrl and credentials; the current config reference explains merge and SecretRef precedence.
3. Check the installed version and failing operation. Issue #141191 reports a 2026.9.2 probe path rejecting a store SecretRef while normal sessions work. It does not establish that all missing-key errors need a plaintext key.

Keep secrets in the documented credential store or environment reference. Share only redacted error text and field names when requesting help. See model-provider authentication and custom-provider fields and precedence.

An upstream HTTP error: check the provider route

Use the actual failed request’s destination, path, status and error body. A 401 from the model host calls for that host’s credential and account checks. A 404 needs the response body and request path before you infer a missing model or wrong API format.

Provider location

models.providers.<provider-id>

Upstream API root

baseUrl uses the provider’s documented base, including its version path where required.

Chat Completions adapter

api: "openai-completions" for an upstream that serves /v1/chat/completions.

Responses adapter

openai-responses only when the upstream supports /v1/responses.

Credential and model

The provider’s own credential reference and exact allowed model ID. Check the model ID and API base directory against its official source.

These fields identify what to inspect; they are not a complete runnable config or a verified live model call. For a captured model HTTP response, retain its status, headers and body, then use the provider-specific error guide. The local response inspector handles supported Chat Completions responses and error bodies, not OpenClaw WebSocket handshakes or arbitrary logs.

Serving an API from OpenClaw is a different direction

Configuring an upstream provider makes OpenClaw a client. Enabling OpenClaw’s own /v1/chat/completions makes it a server for another client. The inbound HTTP reference says this surface is disabled by default and uses Gateway authentication with operator access. Enabling it does not repair an outbound provider credential.

For that inbound surface, the model field selects an OpenClaw agent target, not the raw upstream model ID. Keep the two URL/key/model sets separate; never paste a Gateway operator token into a public API tool.

Does the free ChinaGenAI route fit?

It provides a small Chat Completions route, not a full OpenClaw agent service. Its 6-message, 6,000-character normalized JSON input and 256-output-token limits can exclude agent prompts and long tool histories. Use a provider whose context, output and tool support fit your task; check the site’s endpoint support and current limits before choosing it.