Skip to content

[Bug]: OpenRouter "401 Missing Authentication header" on OpenClaw 2026.6.10 — confirmed fixed by downgrade to 2026.6.1 #97934

Description

@laurencebrown

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

Related to #51056 (closed) — this looks like a recurrence on 2026.6.10.

On OpenClaw 2026.6.10, all OpenRouter model calls fail with 401 Missing Authentication header despite a verified-valid API key, correctly stored auth profile, and correct profile selection. The same key, same machine, same agent config works immediately after downgrading to OpenClaw 2026.6.1. This appears to be a recurrence of the pattern in #51056 (closed) and related issues (#34830, #42839), now reproduced cleanly on 2026.6.10 with every other variable ruled out.

Steps to reproduce

Run a working OpenClaw 2026.6.1 setup with a valid OpenRouter api_key auth profile.
Update to 2026.6.10 via npm install -g [email protected] (in this case via repeated npm uninstall -g openclaw + curl install.sh cycles, landing on 2026.6.10).
Run openclaw models status --probe.

Expected behavior

OpenClaw should send Authorization: Bearer <api_key> to OpenRouter and receive a normal response.

Actual behavior

All probes against openrouter/deepseek/deepseek-v4-pro fail:

openrouter/deepseek/deepseek-v4-pro │ openrouter:manual (api_key) │ 401 Missing Authentication header

OpenClaw version

OpenClaw version (broken): 2026.6.10 (aa69b12) OpenClaw version (working): 2026.6.1 (2e08f0f)

Operating system

OS: macOS 25.6.1 (Mac Studio, Apple Silicon)

Install method

npm global (/opt/homebrew/lib/node_modules/openclaw) Provider:

Model

openrouter/deepseek/deepseek-v4-pro

Provider / routing chain

OpenRouter, Auth mode: api_key

Additional provider/model setup details

No response

Logs

Screenshots, recordings, and evidence

No response

Impact and severity

Total OpenRouter outage for any agent on 2026.6.10 using API-key auth, with no available workaround short of switching providers or downgrading the OpenClaw version.

Additional information

OpenClaw version (broken): 2026.6.10 (aa69b12)
OpenClaw version (working): 2026.6.1 (2e08f0f)
OS: macOS (Mac Studio, Apple Silicon)
Install method: npm global (/opt/homebrew/lib/node_modules/openclaw)
Provider: OpenRouter, model openrouter/deepseek/deepseek-v4-pro
Auth mode: api_key

Resolution

Downgrading via:

npm uninstall -g openclaw
npm install -g [email protected]
openclaw doctor --fix

restores normal function immediately. models status --probe returns ok on the same model/profile, both with and without the env var set, in a fresh shell session with no other changes.

Suspected cause

Given the auth-profile storage migrated from JSON (auth-profiles.json) to SQLite (openclaw-agent.sqlite) in this version range, and given prior closed issues (#51056) describing the same symptom tied to profile/header construction, this looks like a regression in how the OpenRouter provider plugin reads the resolved credential out of the newer SQLite-backed auth resolution path and attaches it to the outbound request — not a credential, storage, or config problem on the user's end.

Metadata

Metadata

Assignees

No one assigned

    Labels

    P1High-priority user-facing bug, regression, or broken workflow.bugSomething isn't workingclawsweeper:needs-live-reproClawSweeper needs live local, crabbox, or manual validation to confirm this issue.impact:auth-providerAuth, provider routing, model choice, or SecretRef resolution may break.issue-rating: 🐚 platinum hermitGood issue quality with a plausible reproduction path needing some confirmation.maturity:stableIssue affects a taxonomy feature currently scored M4/M5.regressionBehavior that previously worked and now fails

    Type

    No type

    Fields

    Priority

    None yet

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions