Version: OpenClaw 2026.5.28 (e932160)
Platform: Windows (PowerShell)
Severity: High — main config truncation prevented only by size-drop guard; auth-profiles silently loses existing profiles

Summary

openclaw models auth login --provider <name> has two independent destructive behaviors:

1. It writes to openclaw.json (it shouldn't — should only touch auth-profiles.json), shrinking it from ~28KB to ~9KB. The size-drop guard catches and rejects the write, but that's the only thing preventing data loss.
2. It overwrites auth-profiles.json in a way that drops pre-existing profiles for other providers, rather than merging.

Additionally, the type field only accepts "api_key" (snake_case); "apiKey" (camelCase) is silently ignored.

Reproduction

# Starting state: auth-profiles.json contains a valid deepseek:default profile
openclaw models status   # shows deepseek auth healthy

# Try to add OpenAI key via CLI
openclaw models auth login --provider openai
# (enter valid OpenAI API key when prompted)

Expected

• auth-profiles.json gets a new openai:default profile merged in
• Existing deepseek:default profile is preserved
• openclaw.json is untouched

Actual

Symptom 1: openclaw.json write rejected

Config write rejected: <path>/openclaw.json (size-drop:28183→9212).
Rejected payload saved to <path>/openclaw.json.rejected.<ISO-timestamp>.
Error: Config write rejected: <path>/openclaw.json

The size-drop guard is the only thing preventing complete config truncation.

Symptom 2: auth-profiles.json profiles wiped
After the command, auth-profiles.json contains only the newly-added provider — the previously working deepseek:default (and any others) are gone.

Symptom 3: camelCase type silently ignored
If the file is manually edited with "type": "apiKey", the profile is silently ignored with no error — only "type": "api_key" works.

Impact

• Users following CLI prompts to add a new provider silently lose auth for all existing providers
• The only thing preventing catastrophic config loss is the size-drop guard
• Misleading: the command name suggests it only touches auth, not main config

Suggested Fix

1. models auth login should write only to auth-profiles.json, never to openclaw.json
2. auth-profiles.json writes should merge with existing profiles, not overwrite
3. type field should normalize camelCase apiKey → api_key, or at minimum reject with a clear error