[Bug]: Moonshot CN API doesn't work: HTTP 401 #33637
Description
Bug type
Behavior bug (incorrect output/state without crash)
Summary
I created a Moonshot API key at platform.moonshot.cn (CN), and entered the API key (sk-xxxxxxxxxx) into OpenClaw, but the agent keeps encountering HTTP 401 error, even though I tried all three methods (API .cn, API .ai, Kimi Code).
Steps to reproduce
- Create an API Key in platform.moonshot.cn
- Enter the API key in OpenClaw onboarding and choose the API .cn auth method
- Use moonshot/kimi-k2.5 as the default model
- Try to hatch the agent but it won't work because of HTTP 401 error
Expected behavior
The agent should output text.
Actual behavior
HTTP 401: Invalid Authentication
OpenClaw version
2026.2.26
Operating system
Kali Linux
Install method
No response
Logs, screenshots, and evidence
◇ I understand this is personal-by-default and shared/multi-user use requires lock-down. Continue?
│ Yes
│
◇ Onboarding mode
│ QuickStart
│
◇ Existing config detected ─────────╮
│ │
│ workspace: ~/.openclaw/workspace │
│ model: moonshot/kimi-k2.5 │
│ gateway.mode: local │
│ gateway.port: 18789 │
│ gateway.bind: loopback │
│ │
├────────────────────────────────────╯
│
◇ Config handling
│ Update values
│
◇ QuickStart ─────────────────────────────╮
│ │
│ Keeping your current gateway settings: │
│ Gateway port: 18789 │
│ Gateway bind: Loopback (127.0.0.1) │
│ Gateway auth: Token (default) │
│ Tailscale exposure: Off │
│ Direct to chat channels. │
│ │
├──────────────────────────────────────────╯
│
◇ Model/auth provider
│ Moonshot AI (Kimi K2.5)
│
◇ Moonshot AI (Kimi K2.5) auth method
│ Kimi API key (.cn)
│
◇ How do you want to provide this API key?
│ Paste API key now
│
◇ Enter Moonshot API key (.cn)
│ sk-xxxxxxxxxxxxxxxxxxxxxx (API key hidden by me)
│
◇ Model configured ────────────────────────╮
│ │
│ Default model set to moonshot/kimi-k2.5 │
│ │
├───────────────────────────────────────────╯
│
◇ Default model
│ Keep current (moonshot/kimi-k2.5)
│
◇ Channel status ────────────────────────────╮
│ │
│ Telegram: needs token │
│ WhatsApp (default): not linked │
│ Discord: needs token │
│ Slack: needs tokens │
│ Signal: needs setup │
│ signal-cli: missing (signal-cli) │
│ iMessage: needs setup │
│ imsg: missing (imsg) │
│ IRC: not configured │
│ Google Chat: not configured │
│ Feishu: install plugin to enable │
│ Google Chat: install plugin to enable │
│ Nostr: install plugin to enable │
│ Microsoft Teams: install plugin to enable │
│ Mattermost: install plugin to enable │
│ Nextcloud Talk: install plugin to enable │
│ Matrix: install plugin to enable │
│ BlueBubbles: install plugin to enable │
│ LINE: install plugin to enable │
│ Zalo: install plugin to enable │
│ Zalo Personal: install plugin to enable │
│ Synology Chat: install plugin to enable │
│ Tlon: install plugin to enable │
│ │
├─────────────────────────────────────────────╯
│
◇ How channels work ───────────────────────────────────────────────────────────────────────╮
│ │
│ DM security: default is pairing; unknown DMs get a pairing code. │
│ Approve with: openclaw pairing approve <channel> <code> │
│ Public DMs require dmPolicy="open" + allowFrom=["*"]. │
│ Multi-user DMs: run: openclaw config set session.dmScope "per-channel-peer" (or │
│ "per-account-channel-peer" for multi-account channels) to isolate sessions. │
│ Docs: channels/pairing │
│ │
│ Telegram: simplest way to get started — register a bot with @BotFather and get going. │
│ WhatsApp: works with your own number; recommend a separate phone + eSIM. │
│ Discord: very well supported right now. │
│ IRC: classic IRC networks with DM/channel routing and pairing controls. │
│ Google Chat: Google Workspace Chat app with HTTP webhook. │
│ Slack: supported (Socket Mode). │
│ Signal: signal-cli linked device; more setup (David Reagans: "Hop on Discord."). │
│ iMessage: this is still a work in progress. │
│ Feishu: 飞书/Lark enterprise messaging with doc/wiki/drive tools. │
│ Nostr: Decentralized protocol; encrypted DMs via NIP-04. │
│ Microsoft Teams: Bot Framework; enterprise support. │
│ Mattermost: self-hosted Slack-style chat; install the plugin to enable. │
│ Nextcloud Talk: Self-hosted chat via Nextcloud Talk webhook bots. │
│ Matrix: open protocol; install the plugin to enable. │
│ BlueBubbles: iMessage via the BlueBubbles mac app + REST API. │
│ LINE: LINE Messaging API bot for Japan/Taiwan/Thailand markets. │
│ Zalo: Vietnam-focused messaging platform with Bot API. │
│ Zalo Personal: Zalo personal account via QR code login. │
│ Synology Chat: Connect your Synology NAS Chat to OpenClaw with full agent capabilities. │
│ Tlon: decentralized messaging on Urbit; install the plugin to enable. │
│ │
├───────────────────────────────────────────────────────────────────────────────────────────╯
│
◇ Select channel (QuickStart)
│ Skip for now
Config overwrite: /home/knox/.openclaw/openclaw.json (sha256 774db302800cdd9a802492f859be7cfd62da2ddedf667a4b68296e515e3bad1f -> f50376745646262f59923df51793373e4e317f762ab20be172ce7e1d36760273, backup=/home/knox/.openclaw/openclaw.json.bak)
Updated ~/.openclaw/openclaw.json
Workspace OK: ~/.openclaw/workspace
Sessions OK: ~/.openclaw/agents/main/sessions
│
◇ Skills status ─────────────╮
│ │
│ Eligible: 5 │
│ Missing requirements: 39 │
│ Unsupported on this OS: 7 │
│ Blocked by allowlist: 0 │
│ │
├─────────────────────────────╯
│
◇ Configure skills now? (recommended)
│ Yes
│
◇ Install missing skill dependencies
│ Skip for now
│
◇ Set GOOGLE_PLACES_API_KEY for goplaces?
│ No
│
◇ Set GEMINI_API_KEY for nano-banana-pro?
│ No
│
◇ Set NOTION_API_KEY for notion?
│ No
│
◇ Set OPENAI_API_KEY for openai-image-gen?
│ No
│
◇ Set OPENAI_API_KEY for openai-whisper-api?
│ No
│
◇ Set ELEVENLABS_API_KEY for sag?
│ No
│
◇ Hooks ──────────────────────────────────────────────────────────────────╮
│ │
│ Hooks let you automate actions when agent commands are issued. │
│ Example: Save session context to memory when you issue /new or /reset. │
│ │
│ Learn more: https://docs.openclaw.ai/automation/hooks │
│ │
├──────────────────────────────────────────────────────────────────────────╯
│
◇ Enable hooks?
│ Skip for now
Config overwrite: /home/knox/.openclaw/openclaw.json (sha256 f50376745646262f59923df51793373e4e317f762ab20be172ce7e1d36760273 -> 46fe9e952a3c99f4abef7476173f43fccb0a0ab4ba2a9f06d015a8ddc03c9768, backup=/home/knox/.openclaw/openclaw.json.bak)
│
◇ Gateway service runtime ────────────────────────────────────────────╮
│ │
│ QuickStart uses Node for the Gateway service (stable + supported). │
│ │
├──────────────────────────────────────────────────────────────────────╯
│
◇ Gateway service already installed
│ Restart
│
Restarted systemd service: openclaw-gateway.service
◇ Gateway service restarted.
│
◇
Agents: main (default)
Heartbeat interval: 30m (main)
Session store (main): /home/knox/.openclaw/agents/main/sessions/sessions.json (1 entries)
- agent:main:main (1m ago)
│
◇ Optional apps ────────────────────────╮
│ │
│ Add nodes for extra features: │
│ - macOS app (system + notifications) │
│ - iOS app (camera/canvas) │
│ - Android app (camera/canvas) │
│ │
├────────────────────────────────────────╯
│
◇ Control UI ─────────────────────────────────────────────────────────────────────╮
│ │
│ Web UI: http://127.0.0.1:18789/ │
│ Web UI (with token): │
│ http://127.0.0.1:18789/#token=be7c602c07a7b677e777c3d409fa87569a49d71b56b9dea5 │
│ Gateway WS: ws://127.0.0.1:18789 │
│ Gateway: reachable │
│ Docs: https://docs.openclaw.ai/web/control-ui │
│ │
├──────────────────────────────────────────────────────────────────────────────────╯
│
◇ Start TUI (best option!) ─────────────────────────────────╮
│ │
│ This is the defining action that makes your agent you. │
│ Please take your time. │
│ The more you tell it, the better the experience will be. │
│ We will send: "Wake up, my friend!" │
│ │
├────────────────────────────────────────────────────────────╯
│
◇ Token ─────────────────────────────────────────────────────────────────────────────────╮
│ │
│ Gateway token: shared auth for the Gateway + Control UI. │
│ Stored in: ~/.openclaw/openclaw.json (gateway.auth.token) or OPENCLAW_GATEWAY_TOKEN. │
│ View token: openclaw config get gateway.auth.token │
│ Generate token: openclaw doctor --generate-gateway-token │
│ Web UI stores a copy in this browser's localStorage (openclaw.control.settings.v1). │
│ Open the dashboard anytime: openclaw dashboard --no-open │
│ If prompted: paste the token into Control UI settings (or use the tokenized dashboard │
│ URL). │
│ │
├─────────────────────────────────────────────────────────────────────────────────────────╯
│
◇ How do you want to hatch your bot?
│ Hatch in TUI (recommended)
openclaw tui - ws://127.0.0.1:18789 - agent main - session main
session agent:main:main
A new session was started via /new or /reset. Execute your Session Startup sequence now - read the required files before responding to the
user. Then greet the user in your configured persona, if one is provided. Be yourself - use your defined voice, mannerisms, and mood. Keep it
to 1-3 sentences and ask what they want to do. If the runtime model differs from default_model in the system prompt, mention the default
model. Do not mention internal steps, files, tools, or reasoning.
HTTP 401: Invalid Authentication
Wake up, my friend!
run error: HTTP 401: Invalid Authentication
connected | press ctrl+c again to exit
agent main | session main (openclaw-tui) | moonshot/kimi-k2.5 | tokens ?/256kImpact and severity
No response
Additional information
No response