From 0ab160cda9ac33bcc8435cee2bb50b0ea3ba25e5 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sat, 4 Apr 2026 15:46:13 +0900 Subject: [PATCH] docs(anthropic): remove setup-token setup docs --- CHANGELOG.md | 1 + docs/cli/index.md | 21 ++----- docs/cli/models.md | 6 +- docs/concepts/model-providers.md | 8 +-- docs/concepts/models.md | 10 ++-- docs/concepts/oauth.md | 52 +++++------------ docs/concepts/session-pruning.md | 8 +-- docs/gateway/authentication.md | 76 +++++++------------------ docs/gateway/configuration-examples.md | 47 +-------------- docs/gateway/doctor.md | 2 +- docs/gateway/heartbeat.md | 4 +- docs/help/faq.md | 57 ++++++------------- docs/help/testing.md | 20 ------- docs/providers/anthropic.md | 79 +++++++------------------- docs/providers/claude-max-api-proxy.md | 2 +- docs/reference/api-usage-costs.md | 2 +- docs/reference/wizard.md | 2 +- docs/start/wizard-cli-automation.md | 7 +-- docs/start/wizard-cli-reference.md | 8 --- docs/start/wizard.md | 2 +- 20 files changed, 108 insertions(+), 306 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8c8880d2526..c67e6aff6bb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -29,6 +29,7 @@ Docs: https://docs.openclaw.ai - Docs/memory: add a dedicated Dreaming concept page, expand Memory overview with the Dreaming model, and link Dreaming from further reading to document the experimental opt-in consolidation workflow. Thanks @vignesh07. - Agents/cache prefixes: route compaction, OpenAI WebSocket HTTP fallback, and later-turn embedded session reuse through the same cache-safe prompt shaping path so Anthropic-family and OpenAI-family requests keep stable prompt bytes across follow-up turns and fallback transport changes. (#60691) Thanks @vincentkoc. - Agents/Claude CLI: expose OpenClaw tools to background Claude CLI runs through a loopback MCP bridge that reuses gateway tool policy, honors session/account/channel scoping, and only advertises the bridge when the local runtime is actually live. (#35676) Thanks @mylukin. +- Providers/Anthropic: remove setup-token from new onboarding and auth-command setup paths, keep existing configured legacy token profiles runnable, and steer new Anthropic setup to Claude CLI or API keys. ### Fixes diff --git a/docs/cli/index.md b/docs/cli/index.md index ee120e5dd6e..391a9fc452b 100644 --- a/docs/cli/index.md +++ b/docs/cli/index.md @@ -426,7 +426,7 @@ Options: - `--mode ` - `--flow ` (manual is an alias for advanced) - `--auth-choice ` where `` is one of: - `setup-token`, `token`, `chutes`, `deepseek-api-key`, `openai-codex`, `openai-api-key`, + `chutes`, `deepseek-api-key`, `openai-codex`, `openai-api-key`, `openrouter-api-key`, `kilocode-api-key`, `litellm-api-key`, `ai-gateway-api-key`, `cloudflare-ai-gateway-api-key`, `moonshot-api-key`, `moonshot-api-key-cn`, `kimi-code-api-key`, `synthetic-api-key`, `venice-api-key`, `together-api-key`, @@ -437,10 +437,6 @@ Options: `mistral-api-key`, `volcengine-api-key`, `byteplus-api-key`, `qianfan-api-key`, `modelstudio-standard-api-key-cn`, `modelstudio-standard-api-key`, `modelstudio-api-key-cn`, `modelstudio-api-key`, `custom-api-key`, `skip` -- `--token-provider ` (non-interactive; used with `--auth-choice token`) -- `--token ` (non-interactive; used with `--auth-choice token`) -- `--token-profile-id ` (non-interactive; default: `:manual`) -- `--token-expires-in ` (non-interactive; e.g. `365d`, `12h`) - `--secret-input-mode ` (default `plaintext`; use `ref` to store provider default env refs instead of plaintext keys) - `--anthropic-api-key ` - `--openai-api-key ` @@ -986,17 +982,9 @@ Tip: these config write RPCs preflight active SecretRef resolution for refs in t See [/concepts/models](/concepts/models) for fallback behavior and scanning strategy. -Anthropic setup-token (supported): - -```bash -claude setup-token -openclaw models auth setup-token --provider anthropic -openclaw models status -``` - Billing note: Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**. Anthropic says Claude subscription limits no -longer cover OpenClaw, and setup-token usage in OpenClaw now requires **Extra +longer cover OpenClaw, and Claude CLI usage in OpenClaw now requires **Extra Usage** billed separately from the subscription. For production, prefer an Anthropic API key or another supported subscription-style provider such as OpenAI Codex, Alibaba Cloud Model Studio Coding Plan, MiniMax Coding Plan, or @@ -1010,6 +998,9 @@ openclaw models auth login --provider anthropic --method cli --set-default Onboarding shortcut: `openclaw onboard --auth-choice anthropic-cli` +Existing legacy Anthropic token profiles still run if already configured, but +OpenClaw no longer offers Anthropic setup-token as a new auth path. + Legacy alias note: `claude-cli` is the deprecated onboarding auth-choice alias. Use `anthropic-cli` for onboarding, or use `models auth login` directly. @@ -1107,7 +1098,7 @@ Options: - `add`: interactive auth helper - `login`: `--provider `, `--method `, `--set-default` - `login-github-copilot`: GitHub Copilot OAuth login flow -- `setup-token`: `--provider ` (default `anthropic`), `--yes` +- `setup-token`: `--provider `, `--yes` - `paste-token`: `--provider `, `--profile-id `, `--expires-in ` ### `models auth order get|set|clear` diff --git a/docs/cli/models.md b/docs/cli/models.md index 5f447740063..d7d982025ef 100644 --- a/docs/cli/models.md +++ b/docs/cli/models.md @@ -67,7 +67,7 @@ openclaw models fallbacks list ```bash openclaw models auth add openclaw models auth login --provider -openclaw models auth setup-token +openclaw models auth setup-token --provider openclaw models auth paste-token ``` @@ -85,6 +85,6 @@ Notes: - `login --provider anthropic --method cli --set-default` reuses a local Claude CLI login and rewrites the main Anthropic default-model path to `claude-cli/...`. -- `setup-token` prompts for a setup-token value (generate it with `claude setup-token` on any machine). - `paste-token` accepts a token string generated elsewhere or from automation. -- Anthropic billing note: Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover OpenClaw, and setup-token usage in OpenClaw now requires **Extra Usage** billed separately from the subscription. +- Anthropic billing note: Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover OpenClaw, and Claude CLI traffic in OpenClaw now requires **Extra Usage** billed separately from the subscription. +- Existing legacy Anthropic token profiles still run if already configured, but OpenClaw no longer offers Anthropic setup-token as a new auth path. diff --git a/docs/concepts/model-providers.md b/docs/concepts/model-providers.md index a9ee40ead83..f90ba0ffdb3 100644 --- a/docs/concepts/model-providers.md +++ b/docs/concepts/model-providers.md @@ -174,13 +174,13 @@ OpenClaw ships with the pi‑ai catalog. These providers require **no** ### Anthropic - Provider: `anthropic` -- Auth: `ANTHROPIC_API_KEY` or `claude setup-token` +- Auth: `ANTHROPIC_API_KEY` - Optional rotation: `ANTHROPIC_API_KEYS`, `ANTHROPIC_API_KEY_1`, `ANTHROPIC_API_KEY_2`, plus `OPENCLAW_LIVE_ANTHROPIC_KEY` (single override) - Example model: `anthropic/claude-opus-4-6` -- CLI: `openclaw onboard --auth-choice token` (paste setup-token) or `openclaw models auth paste-token --provider anthropic` +- CLI: `openclaw onboard --auth-choice apiKey` or `openclaw onboard --auth-choice anthropic-cli` - Direct public Anthropic requests support the shared `/fast` toggle and `params.fastMode`, including API-key and OAuth-authenticated traffic sent to `api.anthropic.com`; OpenClaw maps that to Anthropic `service_tier` (`auto` vs `standard_only`) -- Billing note: Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover OpenClaw, and subscription-auth traffic now requires **Extra Usage** billed separately from the subscription. -- Recommendation: Anthropic API key auth is the safer, recommended path over subscription setup-token auth. +- Billing note: Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover OpenClaw, and Claude CLI traffic now requires **Extra Usage** billed separately from the subscription. +- Existing legacy Anthropic token profiles still run if already configured, but new setup is no longer offered through onboarding or auth commands. ```json5 { diff --git a/docs/concepts/models.md b/docs/concepts/models.md index 96f88022ab3..32dd999f25c 100644 --- a/docs/concepts/models.md +++ b/docs/concepts/models.md @@ -44,7 +44,7 @@ openclaw onboard ``` It can set up model + auth for common providers, including **OpenAI Code (Codex) -subscription** (OAuth) and **Anthropic** (API key or `claude setup-token`). +subscription** (OAuth) and **Anthropic** (API key or Claude CLI). ## Config keys (overview) @@ -163,12 +163,14 @@ JSON includes `auth.oauth` (warn window + profiles) and `auth.providers` (effective auth per provider). Use `--check` for automation (exit `1` when missing/expired, `2` when expiring). -Auth choice is provider/account dependent. For always-on gateway hosts, API keys are usually the most predictable; subscription token flows are also supported. +Auth choice is provider/account dependent. For always-on gateway hosts, API +keys are usually the most predictable; Claude CLI reuse and existing legacy +Anthropic token profiles are also supported. -Example (Anthropic setup-token): +Example (Claude CLI): ```bash -claude setup-token +claude auth login openclaw models status ``` diff --git a/docs/concepts/oauth.md b/docs/concepts/oauth.md index a25ee5b0144..628cc2b2587 100644 --- a/docs/concepts/oauth.md +++ b/docs/concepts/oauth.md @@ -3,7 +3,7 @@ summary: "OAuth in OpenClaw: token exchange, storage, and multi-account patterns read_when: - You want to understand OpenClaw OAuth end-to-end - You hit token invalidation / logout issues - - You want setup-token, Claude CLI, or OAuth auth flows + - You want Claude CLI or OAuth auth flows - You want multiple accounts or profile routing title: "OAuth" --- @@ -11,15 +11,15 @@ title: "OAuth" # OAuth OpenClaw supports “subscription auth” via OAuth for providers that offer it -(notably **OpenAI Codex (ChatGPT OAuth)**). For Anthropic subscriptions, you -can either use the **setup-token** flow or reuse a local **Claude CLI** login -on the gateway host, but Anthropic changed third-party harness billing on +(notably **OpenAI Codex (ChatGPT OAuth)**). For Anthropic subscriptions, new +setup should use the local **Claude CLI** login path on the gateway host, but +Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**: Anthropic says Claude subscription limits no longer cover OpenClaw and Anthropic now requires **Extra Usage** for that traffic. OpenAI Codex OAuth is explicitly supported for use in external tools like OpenClaw. This page explains: -For Anthropic in production, API key auth is the safer recommended path over subscription setup-token auth. +For Anthropic in production, API key auth is the safer recommended path. - how the OAuth **token exchange** works (PKCE) - where tokens are **stored** (and why) @@ -64,14 +64,15 @@ All of the above also respect `$OPENCLAW_STATE_DIR` (state dir override). Full r For static secret refs and runtime snapshot activation behavior, see [Secrets Management](/gateway/secrets). -## Anthropic setup-token (subscription auth) +## Anthropic legacy token compatibility Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover -OpenClaw or other third-party harnesses. Anthropic setup-token support remains -technically usable in OpenClaw, but Anthropic now requires **Extra Usage** -(pay-as-you-go billed separately from the subscription) for that traffic. +OpenClaw or other third-party harnesses. Existing Anthropic token profiles +remain technically usable in OpenClaw, but Anthropic now requires **Extra +Usage** (pay-as-you-go billed separately from the subscription) for that +traffic. If you want other subscription-style options in OpenClaw, see [OpenAI Codex](/providers/openai), [Alibaba Cloud Model Studio Coding @@ -79,23 +80,9 @@ Plan](/providers/qwen_modelstudio), [MiniMax Coding Plan](/providers/minimax), and [Z.AI / GLM Coding Plan](/providers/glm). -Run `claude setup-token` on any machine, then paste it into OpenClaw: - -```bash -openclaw models auth setup-token --provider anthropic -``` - -If you generated the token elsewhere, paste it manually: - -```bash -openclaw models auth paste-token --provider anthropic -``` - -Verify: - -```bash -openclaw models status -``` +OpenClaw no longer offers Anthropic setup-token onboarding or auth commands for +new setup. Existing legacy Anthropic token profiles are still honored at +runtime if they are already configured. ## Anthropic Claude CLI migration @@ -136,16 +123,10 @@ openclaw models status OpenClaw’s interactive login flows are implemented in `@mariozechner/pi-ai` and wired into the wizards/commands. -### Anthropic setup-token / Claude CLI +### Anthropic Claude CLI Flow shape: -Setup-token path: - -1. run `claude setup-token` -2. paste the token into OpenClaw -3. store as a token auth profile (no refresh) - Claude CLI path: 1. sign in with `claude auth login` on the gateway host @@ -157,11 +138,6 @@ Interactive assistant path: - `openclaw onboard` / `openclaw configure` → auth choice `anthropic-cli` -Manual setup-token path: - -- `openclaw models auth setup-token --provider anthropic` -- `openclaw models auth paste-token --provider anthropic` - ### OpenAI Codex (ChatGPT OAuth) OpenAI Codex OAuth is explicitly supported for use outside the Codex CLI, including OpenClaw workflows. diff --git a/docs/concepts/session-pruning.md b/docs/concepts/session-pruning.md index fe61947fbc1..27a8f2e70d3 100644 --- a/docs/concepts/session-pruning.md +++ b/docs/concepts/session-pruning.md @@ -39,10 +39,10 @@ cache-write size, directly lowering cost. OpenClaw auto-enables pruning for Anthropic profiles: -| Profile type | Pruning enabled | Heartbeat | -| -------------------- | --------------- | --------- | -| OAuth or setup-token | Yes | 1 hour | -| API key | Yes | 30 min | +| Profile type | Pruning enabled | Heartbeat | +| ------------------------------- | --------------- | --------- | +| Claude CLI or legacy token auth | Yes | 1 hour | +| API key | Yes | 30 min | If you set explicit values, OpenClaw does not override them. diff --git a/docs/gateway/authentication.md b/docs/gateway/authentication.md index a542b31e500..e5b59f2a164 100644 --- a/docs/gateway/authentication.md +++ b/docs/gateway/authentication.md @@ -1,5 +1,5 @@ --- -summary: "Model authentication: OAuth, API keys, and setup-token" +summary: "Model authentication: OAuth, API keys, and Claude CLI reuse" read_when: - Debugging model auth or OAuth expiry - Documenting authentication or credential storage @@ -9,7 +9,7 @@ title: "Authentication" # Authentication (Model Providers) -This page covers **model provider** authentication (API keys, OAuth, setup tokens). For **gateway connection** authentication (token, password, trusted-proxy), see [Configuration](/gateway/configuration) and [Trusted Proxy Auth](/gateway/trusted-proxy-auth). +This page covers **model provider** authentication (API keys, OAuth, Claude CLI reuse). For **gateway connection** authentication (token, password, trusted-proxy), see [Configuration](/gateway/configuration) and [Trusted Proxy Auth](/gateway/trusted-proxy-auth). OpenClaw supports OAuth and API keys for model providers. For always-on gateway @@ -26,8 +26,8 @@ For credential eligibility/reason-code rules used by `models status --probe`, se If you’re running a long-lived gateway, start with an API key for your chosen provider. -For Anthropic specifically, API key auth is the safe path and is recommended -over subscription setup-token auth. +For Anthropic specifically, API key auth is the safe path. Claude CLI reuse is +the other supported subscription-style setup path. 1. Create an API key in your provider console. 2. Put it on the **gateway host** (the machine running `openclaw gateway`). @@ -59,53 +59,18 @@ API keys for daemon use: `openclaw onboard`. See [Help](/help) for details on env inheritance (`env.shellEnv`, `~/.openclaw/.env`, systemd/launchd). -## Anthropic: setup-token (subscription auth) +## Anthropic: legacy token compatibility -If you’re using a Claude subscription, the setup-token flow is supported. Run -it on the **gateway host**: +Existing Anthropic token profiles are still honored at runtime if they are +already configured, but OpenClaw no longer offers Anthropic setup-token auth +for new setup via onboarding or `models auth` commands. -```bash -claude setup-token -``` - -Then paste it into OpenClaw: - -```bash -openclaw models auth setup-token --provider anthropic -``` - -If the token was created on another machine, paste it manually: - -```bash -openclaw models auth paste-token --provider anthropic -``` - -If you see an Anthropic error like: - -``` -This credential is only authorized for use with Claude Code and cannot be used for other API requests. -``` - -…use an Anthropic API key instead. - - -Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM -PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover -OpenClaw or other third-party harnesses. Setup-token auth still works in -OpenClaw, but Anthropic now requires **Extra Usage** (pay-as-you-go billed -separately from the subscription) for that traffic. - -If you want the clearest path for always-on or team gateways, prefer an -Anthropic API key. OpenClaw also supports other subscription-style options, -including [OpenAI Codex](/providers/openai), [Alibaba Cloud Model Studio Coding -Plan](/providers/qwen_modelstudio), [MiniMax Coding Plan](/providers/minimax), -and [Z.AI / GLM Coding Plan](/providers/glm). - +For new setup, use an Anthropic API key or migrate to Claude CLI on the gateway +host. Manual token entry (any provider; writes `auth-profiles.json` + updates config): ```bash -openclaw models auth paste-token --provider anthropic openclaw models auth paste-token --provider openrouter ``` @@ -124,14 +89,12 @@ openclaw models status --check Optional ops scripts (systemd/Termux) are documented here: [Auth monitoring scripts](/help/scripts#auth-monitoring-scripts) -> `claude setup-token` requires an interactive TTY. - ## Anthropic: Claude CLI migration If Claude CLI is already installed and signed in on the gateway host, you can -switch an existing Anthropic setup over to the CLI backend instead of pasting a -setup-token. This is a supported OpenClaw migration path for reusing a local -Claude CLI login on that host. +switch an existing Anthropic setup over to the CLI backend. This is a +supported OpenClaw migration path for reusing a local Claude CLI login on that +host. Prerequisites: @@ -159,8 +122,7 @@ openclaw onboard --auth-choice anthropic-cli ``` Interactive `openclaw onboard` and `openclaw configure` prefer Claude CLI for -Anthropic and do not show setup-token in the assistant picker. Setup-token -remains supported through the manual commands above. +Anthropic and no longer offer setup-token as a new setup path. ## Checking model auth status @@ -210,8 +172,8 @@ Use `--agent ` to target a specific agent; omit it to use the configured def ### "No credentials found" -If the Anthropic token profile is missing, run `claude setup-token` on the -**gateway host**, then re-check: +If the Anthropic profile is missing, migrate that setup to Claude CLI or an API +key on the **gateway host**, then re-check: ```bash openclaw models status @@ -219,10 +181,10 @@ openclaw models status ### Token expiring/expired -Run `openclaw models status` to confirm which profile is expiring. If the profile -is missing, rerun `claude setup-token` and paste the token again. +Run `openclaw models status` to confirm which profile is expiring. If a legacy +Anthropic token profile is missing or expired, migrate that setup to Claude CLI +or an API key. ## Requirements -- Anthropic subscription account (for `claude setup-token`) - Claude Code CLI installed (`claude` command available) diff --git a/docs/gateway/configuration-examples.md b/docs/gateway/configuration-examples.md index a5575dc435e..ec865241508 100644 --- a/docs/gateway/configuration-examples.md +++ b/docs/gateway/configuration-examples.md @@ -536,62 +536,19 @@ If more than one person can DM your bot (multiple entries in `allowFrom`, pairin For Discord/Slack/Google Chat/Microsoft Teams/Mattermost/IRC, sender authorization is ID-first by default. Only enable direct mutable name/email/nick matching with each channel's `dangerouslyAllowNameMatching: true` if you explicitly accept that risk. -### OAuth with API key failover +### Anthropic API key + MiniMax fallback ```json5 { auth: { profiles: { - "anthropic:subscription": { - provider: "anthropic", - mode: "oauth", - email: "me@example.com", - }, "anthropic:api": { provider: "anthropic", mode: "api_key", }, }, order: { - anthropic: ["anthropic:subscription", "anthropic:api"], - }, - }, - agent: { - workspace: "~/.openclaw/workspace", - model: { - primary: "anthropic/claude-sonnet-4-6", - fallbacks: ["anthropic/claude-opus-4-6"], - }, - }, -} -``` - -### Anthropic setup-token + API key, MiniMax fallback - - -Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM -PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover -OpenClaw, and Anthropic setup-token traffic now requires **Extra Usage** billed -separately from the subscription. Prefer an Anthropic API key if you want the -clearest billing path. - - -```json5 -{ - auth: { - profiles: { - "anthropic:subscription": { - provider: "anthropic", - mode: "oauth", - email: "user@example.com", - }, - "anthropic:api": { - provider: "anthropic", - mode: "api_key", - }, - }, - order: { - anthropic: ["anthropic:subscription", "anthropic:api"], + anthropic: ["anthropic:api"], }, }, models: { diff --git a/docs/gateway/doctor.md b/docs/gateway/doctor.md index 924ab599815..74998d18f64 100644 --- a/docs/gateway/doctor.md +++ b/docs/gateway/doctor.md @@ -290,7 +290,7 @@ Doctor checks: Doctor inspects OAuth profiles in the auth store, warns when tokens are expiring/expired, and can refresh them when safe. If the Anthropic Claude Code -profile is stale, it suggests running `claude setup-token` (or pasting a setup-token). +profile is stale, it suggests migrating to Claude CLI or an Anthropic API key. Refresh prompts only appear when running interactively (TTY); `--non-interactive` skips refresh attempts. diff --git a/docs/gateway/heartbeat.md b/docs/gateway/heartbeat.md index 4a46f426d48..a8ce33f4f23 100644 --- a/docs/gateway/heartbeat.md +++ b/docs/gateway/heartbeat.md @@ -20,7 +20,7 @@ Troubleshooting: [Scheduled Tasks](/automation/cron-jobs#troubleshooting) ## Quick start (beginner) -1. Leave heartbeats enabled (default is `30m`, or `1h` for Anthropic OAuth/setup-token) or set your own cadence. +1. Leave heartbeats enabled (default is `30m`, or `1h` for Anthropic Claude CLI or legacy token auth) or set your own cadence. 2. Create a tiny `HEARTBEAT.md` checklist in the agent workspace (optional but recommended). 3. Decide where heartbeat messages should go (`target: "none"` is the default; set `target: "last"` to route to the last contact). 4. Optional: enable heartbeat reasoning delivery for transparency. @@ -50,7 +50,7 @@ Example config: ## Defaults -- Interval: `30m` (or `1h` when Anthropic OAuth/setup-token is the detected auth mode). Set `agents.defaults.heartbeat.every` or per-agent `agents.list[].heartbeat.every`; use `0m` to disable. +- Interval: `30m` (or `1h` when Anthropic Claude CLI or legacy token auth is the detected auth mode). Set `agents.defaults.heartbeat.every` or per-agent `agents.list[].heartbeat.every`; use `0m` to disable. - Prompt body (configurable via `agents.defaults.heartbeat.prompt`): `Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.` - The heartbeat prompt is sent **verbatim** as the user message. The system diff --git a/docs/help/faq.md b/docs/help/faq.md index 3cff21d4744..9d8cf321701 100644 --- a/docs/help/faq.md +++ b/docs/help/faq.md @@ -543,7 +543,7 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS, `openclaw onboard` is the recommended setup path. In **local mode** it walks you through: - - **Model/auth setup** (provider OAuth/setup-token flows and API keys supported, plus local model options such as LM Studio) + - **Model/auth setup** (provider OAuth, Claude CLI reuse, and API keys supported, plus local model options such as LM Studio) - **Workspace** location + bootstrap files - **Gateway settings** (bind/port/auth/tailscale) - **Providers** (WhatsApp, Telegram, Discord, Mattermost (plugin), Signal, iMessage) @@ -577,46 +577,26 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS, - Yes. You can either use a **setup-token** or reuse a local **Claude CLI** - login on the gateway host. + Yes, via a local **Claude CLI** login on the gateway host. - Claude Pro/Max subscriptions **do not include an API key**, so this is the - technical path for subscription accounts. But Anthropic changed third-party - harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**: - Anthropic says OpenClaw now requires **Extra Usage** billed separately from - the subscription for this path. If you want the clearest and safest - supported path for production, use an Anthropic API key. - - - - - `claude setup-token` generates a **token string** via the Claude Code CLI (it is not available in the web console). You can run it on **any machine**. Interactive onboarding/configure no longer shows setup-token as an assistant choice; use `openclaw models auth setup-token --provider anthropic` or paste an existing token with `openclaw models auth paste-token --provider anthropic`. The token is stored as an auth profile for the **anthropic** provider and used like an API key (no auto-refresh). More detail: [OAuth](/concepts/oauth). - - - - It is **not** in the Anthropic Console. The setup-token is generated by the **Claude Code CLI** on **any machine**: - - ```bash - claude setup-token - ``` - - Copy the token it prints, then either run `openclaw models auth setup-token --provider anthropic` on the gateway host or paste it there with `openclaw models auth paste-token --provider anthropic`. See [Anthropic](/providers/anthropic). + Claude Pro/Max subscriptions **do not include an API key**, so Claude CLI + reuse is the supported subscription-style path in OpenClaw. Anthropic + changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / + 8:00 PM BST**: Anthropic says OpenClaw now requires **Extra Usage** billed + separately from the subscription for this path. If you want the clearest + and safest supported path for production, use an Anthropic API key. - Yes. You can either: + Yes. Reuse a local **Claude CLI** login on the gateway host with `openclaw models auth login --provider anthropic --method cli --set-default`. - - reuse a local **Claude CLI** login on the gateway host with `openclaw models auth login --provider anthropic --method cli --set-default` - - use a **setup-token** manually with `openclaw models auth setup-token --provider anthropic` - - Claude CLI is the preferred interactive Anthropic path. Setup-token is still supported for manual config. See [Anthropic](/providers/anthropic) and [OAuth](/concepts/oauth). + Existing legacy Anthropic token profiles still run if they are already configured, but OpenClaw no longer offers Anthropic setup-token as a new setup path. See [Anthropic](/providers/anthropic) and [OAuth](/concepts/oauth). Important: Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover OpenClaw, and Anthropic now requires **Extra Usage** billed - separately from the subscription for setup-token or Claude CLI traffic - through OpenClaw. + separately from the subscription for Claude CLI traffic through OpenClaw. For production or multi-user workloads, Anthropic API key auth is the safer, recommended choice. If you want other subscription-style hosted @@ -629,15 +609,15 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS, That means your **Anthropic quota/rate limit** is exhausted for the current window. If you -use a **Claude subscription** (setup-token), wait for the window to -reset or upgrade your plan. If you use an **Anthropic API key**, check the Anthropic Console +use **Claude CLI**, wait for the window to reset or upgrade your plan. If you +use an **Anthropic API key**, check the Anthropic Console for usage/billing and raise limits as needed. If the message is specifically: `Extra usage is required for long context requests`, the request is trying to use Anthropic's 1M context beta (`context1m: true`). That only works when your - credential is eligible for long-context billing (API key billing or subscription - with Extra Usage enabled). + credential is eligible for long-context billing (API key billing or Claude + CLI with Extra Usage enabled). Tip: set a **fallback model** so OpenClaw can keep replying while a provider is rate-limited. See [Models](/cli/models), [OAuth](/concepts/oauth), and @@ -2381,9 +2361,8 @@ for usage/billing and raise limits as needed. This means the run is pinned to an Anthropic auth profile, but the Gateway can't find it in its auth store. - - **Use a setup-token** - - Run `claude setup-token`, then paste it with `openclaw models auth setup-token --provider anthropic`. - - If the token was created on another machine, use `openclaw models auth paste-token --provider anthropic`. + - **Use Claude CLI** + - Run `openclaw models auth login --provider anthropic --method cli --set-default` on the gateway host. - **If you want to use an API key instead** - Put `ANTHROPIC_API_KEY` in `~/.openclaw/.env` on the **gateway host**. - Clear any pinned order that forces a missing profile: @@ -2470,7 +2449,7 @@ Related: [/concepts/oauth](/concepts/oauth) (OAuth flows, token storage, multi-a - **OAuth** often leverages subscription access (where applicable). - **API keys** use pay-per-token billing. - The wizard explicitly supports Anthropic setup-token and OpenAI Codex OAuth and can store API keys for you. + The wizard explicitly supports Anthropic Claude CLI, OpenAI Codex OAuth, and API keys. diff --git a/docs/help/testing.md b/docs/help/testing.md index b7e5a73fcea..98550483363 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -244,26 +244,6 @@ openclaw models list openclaw models list --json ``` -## Live: Anthropic setup-token smoke - -- Test: `src/agents/anthropic.setup-token.live.test.ts` -- Goal: verify Claude Code CLI setup-token (or a pasted setup-token profile) can complete an Anthropic prompt. -- Enable: - - `pnpm test:live` (or `OPENCLAW_LIVE_TEST=1` if invoking Vitest directly) - - `OPENCLAW_LIVE_SETUP_TOKEN=1` -- Token sources (pick one): - - Profile: `OPENCLAW_LIVE_SETUP_TOKEN_PROFILE=anthropic:setup-token-test` - - Raw token: `OPENCLAW_LIVE_SETUP_TOKEN_VALUE=sk-ant-oat01-...` -- Model override (optional): - - `OPENCLAW_LIVE_SETUP_TOKEN_MODEL=anthropic/claude-opus-4-6` - -Setup example: - -```bash -openclaw models auth paste-token --provider anthropic --profile-id anthropic:setup-token-test -OPENCLAW_LIVE_SETUP_TOKEN=1 OPENCLAW_LIVE_SETUP_TOKEN_PROFILE=anthropic:setup-token-test pnpm test:live src/agents/anthropic.setup-token.live.test.ts -``` - ## Live: CLI backend smoke (Claude Code CLI or other local CLIs) - Test: `src/gateway/gateway-cli-backend.live.test.ts` diff --git a/docs/providers/anthropic.md b/docs/providers/anthropic.md index a640e474c6c..283e0f790a4 100644 --- a/docs/providers/anthropic.md +++ b/docs/providers/anthropic.md @@ -1,8 +1,7 @@ --- -summary: "Use Anthropic Claude via API keys, setup-token, or Claude CLI in OpenClaw" +summary: "Use Anthropic Claude via API keys or Claude CLI in OpenClaw" read_when: - You want to use Anthropic models in OpenClaw - - You want setup-token instead of API keys - You want to reuse Claude CLI subscription auth on the gateway host title: "Anthropic" --- @@ -10,13 +9,15 @@ title: "Anthropic" # Anthropic (Claude) Anthropic builds the **Claude** model family and provides access via an API. -In OpenClaw you can authenticate with an API key or a **setup-token**. +In OpenClaw, new Anthropic setup should use an API key or the local Claude CLI +backend. Existing legacy Anthropic token profiles are still honored at runtime +if they are already configured. Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover -OpenClaw or other third-party harnesses. You can still use Anthropic -subscription auth in OpenClaw, but Anthropic now requires **Extra Usage** +OpenClaw or other third-party harnesses. Existing legacy Anthropic token auth +can still run in OpenClaw, but Anthropic now requires **Extra Usage** (pay-as-you-go, billed separately from the subscription) for that traffic. If you want a clearer billing path, use an Anthropic API key instead. OpenClaw @@ -89,7 +90,7 @@ Important limits: ## Prompt caching (Anthropic API) -OpenClaw supports Anthropic's prompt caching feature. This is **API-only**; subscription auth does not honor cache settings. +OpenClaw supports Anthropic's prompt caching feature. This is **API-only**; legacy Anthropic token auth does not honor cache settings. ### Configuration @@ -181,15 +182,15 @@ This only activates when `params.context1m` is explicitly set to `true` for that model. Requirement: Anthropic must allow long-context usage on that credential -(typically API key billing, or a subscription account with Extra Usage +(typically API key billing, or Claude CLI / legacy token auth with Extra Usage enabled). Otherwise Anthropic returns: `HTTP 429: rate_limit_error: Extra usage is required for long context requests`. Note: Anthropic currently rejects `context-1m-*` beta requests when using -subscription setup-tokens (`sk-ant-oat-*`). If you configure `context1m: true` -with subscription auth, OpenClaw logs a warning and falls back to the standard -context window by skipping the context1m beta header while keeping the required -OAuth betas. +legacy Anthropic token auth (`sk-ant-oat-*`). If you configure +`context1m: true` with that legacy auth mode, OpenClaw logs a warning and +falls back to the standard context window by skipping the context1m beta +header while keeping the required OAuth betas. ## Option B: Claude CLI as the message provider @@ -272,7 +273,7 @@ If the `claude` binary is not on the gateway host PATH: ### Migrate from Anthropic auth to Claude CLI -If you currently use `anthropic/...` with a setup-token or API key and want to +If you currently use `anthropic/...` with a legacy token profile or API key and want to switch the same gateway host to Claude CLI, OpenClaw supports that as a normal provider-auth migration path. @@ -294,9 +295,7 @@ openclaw onboard --auth-choice anthropic-cli ``` Interactive `openclaw onboard` and `openclaw configure` now prefer **Anthropic -Claude CLI** first and **Anthropic API key** second. The setup-token flow -remains supported through manual auth commands, but is not shown in the -assistant picker. +Claude CLI** first and **Anthropic API key** second. What this does: @@ -332,67 +331,31 @@ you need to. More details: [/gateway/cli-backends](/gateway/cli-backends) -## Option C: Claude setup-token (manual) - -**Best for:** using your Claude subscription with Anthropic **Extra Usage** -enabled, or while transitioning to API-key billing. - -### Where to get a setup-token - -Setup-tokens are created by the **Claude Code CLI**, not the Anthropic Console. You can run this on **any machine**: - -```bash -claude setup-token -``` - -Then either run it on the gateway host: - -```bash -openclaw models auth setup-token --provider anthropic -``` - -Or if you generated the token on a different machine, paste it: - -```bash -openclaw models auth paste-token --provider anthropic -``` - -### Config snippet (setup-token) - -```json5 -{ - agents: { defaults: { model: { primary: "anthropic/claude-opus-4-6" } } }, -} -``` - ## Notes -- Generate the setup-token with `claude setup-token` and paste it, or run `openclaw models auth setup-token` on the gateway host. - Anthropic says that starting **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**, - OpenClaw usage with Claude subscription auth requires **Extra Usage** + OpenClaw usage with Claude CLI or legacy Anthropic token auth requires **Extra Usage** (pay-as-you-go billed separately from the subscription). -- If you see “OAuth token refresh failed …” on a Claude subscription, re-auth with a setup-token. See [/gateway/troubleshooting](/gateway/troubleshooting). +- Existing legacy Anthropic token profiles are still honored at runtime, but OpenClaw no longer offers setup-token onboarding or auth commands for new setups. - Auth details + reuse rules are in [/concepts/oauth](/concepts/oauth). ## Troubleshooting **401 errors / token suddenly invalid** -- Claude subscription auth can expire or be revoked. Re-run `claude setup-token` - and paste it into the **gateway host**. -- If the Claude CLI login lives on a different machine, use - `openclaw models auth paste-token --provider anthropic` on the gateway host. +- Legacy Anthropic token auth can expire or be revoked. +- For new setup, migrate to an Anthropic API key or the local Claude CLI path on the gateway host. **No API key found for provider "anthropic"** - Auth is **per agent**. New agents don’t inherit the main agent’s keys. -- Re-run onboarding for that agent, or paste a setup-token / API key on the - gateway host, then verify with `openclaw models status`. +- Re-run onboarding for that agent, or configure an API key on the gateway + host, then verify with `openclaw models status`. **No credentials found for profile `anthropic:default`** - Run `openclaw models status` to see which auth profile is active. -- Re-run onboarding, or paste a setup-token / API key for that profile. +- Re-run onboarding, or configure an API key or Claude CLI for that profile path. **No available auth profile (all in cooldown/unavailable)** diff --git a/docs/providers/claude-max-api-proxy.md b/docs/providers/claude-max-api-proxy.md index 885ceb35a94..bd9a331e218 100644 --- a/docs/providers/claude-max-api-proxy.md +++ b/docs/providers/claude-max-api-proxy.md @@ -150,5 +150,5 @@ launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.claude-max-api.plist ## See Also -- [Anthropic provider](/providers/anthropic) - Native OpenClaw integration with Claude setup-token or API keys +- [Anthropic provider](/providers/anthropic) - Native OpenClaw integration with Claude CLI or API keys - [OpenAI provider](/providers/openai) - For OpenAI/Codex subscriptions diff --git a/docs/reference/api-usage-costs.md b/docs/reference/api-usage-costs.md index 7b7e4a34586..b059b94792f 100644 --- a/docs/reference/api-usage-costs.md +++ b/docs/reference/api-usage-costs.md @@ -22,7 +22,7 @@ OpenClaw features that can generate provider usage or paid API calls. **Per-message cost footer** - `/usage full` appends a usage footer to every reply, including **estimated cost** (API-key only). -- `/usage tokens` shows tokens only; OAuth/setup-token/CLI subscription flows hide dollar cost. +- `/usage tokens` shows tokens only; subscription-style OAuth, legacy token, and CLI flows hide dollar cost. Anthropic note: starting **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**, Anthropic says OpenClaw no longer uses included Claude subscription limits. diff --git a/docs/reference/wizard.md b/docs/reference/wizard.md index 1e2412586e5..20cea65dea6 100644 --- a/docs/reference/wizard.md +++ b/docs/reference/wizard.md @@ -32,7 +32,7 @@ For a high-level overview, see [Onboarding (CLI)](/start/wizard). - **Anthropic API key**: uses `ANTHROPIC_API_KEY` if present or prompts for a key, then saves it for daemon use. - **Anthropic Claude CLI**: preferred Anthropic assistant choice in onboarding/configure. On macOS onboarding checks Keychain item "Claude Code-credentials" (choose "Always Allow" so launchd starts don't block); on Linux/Windows it reuses `~/.claude/.credentials.json` if present and switches model selection to `claude-cli/...`. - - **Anthropic setup-token**: still supported as a manual auth flow with `openclaw models auth setup-token --provider anthropic` or `openclaw models auth paste-token --provider anthropic`, but no longer shown in the interactive assistant picker. + - **Anthropic legacy token profiles**: still honored at runtime if already configured, but onboarding/configure no longer offers Anthropic setup-token as a new setup path. - **OpenAI Code (Codex) subscription (Codex CLI)**: if `~/.codex/auth.json` exists, onboarding can reuse it. Reused Codex CLI credentials stay managed by Codex CLI; OpenClaw re-reads that source on expiry instead of rotating the copied refresh token itself. - **OpenAI Code (Codex) subscription (OAuth)**: browser flow; paste the `code#state`. - Sets `agents.defaults.model` to `openai-codex/gpt-5.4` when model is unset or `openai/*`. diff --git a/docs/start/wizard-cli-automation.md b/docs/start/wizard-cli-automation.md index ed98c29f977..0c39afda8ae 100644 --- a/docs/start/wizard-cli-automation.md +++ b/docs/start/wizard-cli-automation.md @@ -195,10 +195,9 @@ openclaw onboard --non-interactive \ -Anthropic setup-token remains supported for manual flows, but interactive -onboarding/configure no longer offers it as an assistant choice. Use -`openclaw models auth setup-token --provider anthropic` or -`openclaw models auth paste-token --provider anthropic` when you need it. +Anthropic setup-token is no longer offered as a new onboarding/configure path. +Existing legacy Anthropic token profiles still run if they are already +configured. ## Add another agent diff --git a/docs/start/wizard-cli-reference.md b/docs/start/wizard-cli-reference.md index b75b6861b40..4930e65c004 100644 --- a/docs/start/wizard-cli-reference.md +++ b/docs/start/wizard-cli-reference.md @@ -138,14 +138,6 @@ What you set: On macOS, choose "Always Allow" so launchd starts do not block. - - - Supported for manual config, not shown as an interactive assistant choice. - - - Generate on any machine: `claude setup-token` - - Run on the gateway host: `openclaw models auth setup-token --provider anthropic` - - Or paste an existing token: `openclaw models auth paste-token --provider anthropic` - If `~/.codex/auth.json` exists, the wizard can reuse it. diff --git a/docs/start/wizard.md b/docs/start/wizard.md index 9a6799382e6..254130851b8 100644 --- a/docs/start/wizard.md +++ b/docs/start/wizard.md @@ -72,7 +72,7 @@ Onboarding starts with **QuickStart** (defaults) vs **Advanced** (full control). For non-interactive runs, `--secret-input-mode ref` stores env-backed refs in auth profiles instead of plaintext API key values. In non-interactive `ref` mode, the provider env var must be set; passing inline key flags without that env var fails fast. In interactive runs, choosing secret reference mode lets you point at either an environment variable or a configured provider ref (`file` or `exec`), with a fast preflight validation before saving. - For Anthropic, interactive onboarding/configure prefers **Anthropic Claude CLI** first, then **Anthropic API key**. The **setup-token** flow remains supported through manual auth commands. + For Anthropic, interactive onboarding/configure prefers **Anthropic Claude CLI** first, then **Anthropic API key**. Existing legacy Anthropic token profiles still run if already configured, but new setup is no longer offered through onboarding or auth commands. 2. **Workspace** — Location for agent files (default `~/.openclaw/workspace`). Seeds bootstrap files. 3. **Gateway** — Port, bind address, auth mode, Tailscale exposure. In interactive token mode, choose default plaintext token storage or opt into SecretRef.