Environment

• Version: 2026.3.2
• OS: macOS
• Provider: Anthropic (claude-sonnet-4-6)

Describe the bug

When running openclaw configure for Anthropic, the OAuth flow correctly obtains both an access token and refresh token. However the refresh token is discarded and the auto-renew mechanism never works, requiring manual re-authentication every ~8 hours despite the refresh token being valid for ~1 year.

Steps to reproduce

1. Run openclaw configure and authenticate with Anthropic via OAuth
2. Use openclaw normally for ~8 hours
3. Token expires — gateway begins returning OAuth token refresh failed for anthropic: Failed to refresh OAuth token for anthropic. Please try again or re-authenticate
4. All Anthropic models fail, fallback chain gets rate-limited, gateway becomes unusable

Root cause (observed via source inspection)

• openclaw configure saves the OAuth result into anthropic:default as type: token — a static credential with no refresh token stored
• The anthropic:claude-cli profile (type: oauth, which does store a refresh token) is not updated when re-running configure
• When the access token expires, refreshOAuthTokenWithLock is called but always fails because no valid refresh token is available
• Running configure again creates a new anthropic:default static token AND adds a broken auth.order entry that puts anthropic:default first, poisoning both Anthropic models simultaneously (since they share provider-level auth)

auth-profiles.json state after configure

"anthropic:default": {
  "type": "token",
  "provider": "anthropic",
  "token": "sk-ant-oat01-..."
}

No refresh field. No expires field. Auto-renew impossible.

openclaw.json corruption after configure

Every openclaw configure run also:

• Resets auth.order to put anthropic:default first (breaking all Anthropic auth)
• Resets model fallbacks (overwriting user's custom fallback chain)

Expected behavior

openclaw configure should:

1. Store the full OAuth credential pair (access + refresh token) into anthropic:claude-cli as type: oauth with a proper expires timestamp
2. Not overwrite auth.order or model fallbacks on subsequent configure runs

Actual behavior

Only the access token is stored as a static type: token. Refresh token is discarded. Auth order is corrupted. Manual re-auth required every ~8h indefinitely.

Workaround

Manually edit ~/.openclaw/agents/main/agent/auth-profiles.json after every configure run:

"anthropic:claude-cli": {
  "type": "oauth",
  "provider": "anthropic",
  "access": "sk-ant-oat01-...",
  "expires": <now + 8h in ms>
}

And manually remove auth.order from openclaw.json.