Bug type

Behavior bug (incorrect output/state without crash)

Summary

OpenClaw's OpenRouter provider is not sending the Authorization: Bearer header, causing all requests to fail with 401 authentication errors.

Environment

• OpenClaw version: 2026.3.13 (61d171a)
• OS: Linux (Debian-based)
• Node version: v22.22.1

Configuration

// ~/.openclaw/openclaw.json
"models": {
"providers": {
"openrouter": {
"baseUrl": "https://openrouter.ai/api/v1",
"api": "openai-completions",
"models": [...]
}
}
},
"auth": {
"profiles": {
"openrouter:default": {
"provider": "openrouter",
"mode": "api_key"
}
}
}

Steps to reproduce

1. Configure OpenRouter as a provider with api_key auth mode
2. Store API key in ~/.openclaw/agents/main/agent/auth-profiles.json
3. Run openclaw models status --probe
4. Observe OpenRouter probe fails with 401

Expected behavior

OpenClaw should send Authorization: Bearer <api_key> header to OpenRouter API.

Actual behavior

│ openrouter/openrouter/auto │ openrouter:default (api_key) │ auth · 694ms
│ │ │ ↳ 401 Missing Authentication header

OpenClaw version

2026.3.13 (61d171a)

Operating system

Linux (Debian-based)

Install method

No response

Model

any openrouter model

Provider / routing chain

openclaw -> openrouter

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

Unable to use OpenRouter.

Additional information

Verification

• ✅ API key is valid (tested with direct curl to /models endpoint)
• ✅ Environment variable OPENROUTER_API_KEY recognized by OpenClaw
• ✅ Moonshot provider with same auth mode works correctly
• ✅ Auth profile shows source=env: OPENROUTER_API_KEY in probe output

Suspected Cause

OpenClaw's OpenRouter provider isn't properly sending the Authorization header despite detecting the API key from auth profiles or environment variables.