openclaw-multi-login-auth

name	openclaw-multi-login-auth
description	Diagnose and fix OpenClaw multi-account model auth (especially openai-codex OAuth) across main/sub-agents. Use when users report "logged in twice but only one profile", need profile isolation by agent, need default-vs-alt routing, or need auth.order tuning and verification.

OpenClaw Multi Login Auth

Stabilize multi-account auth with minimal risk and clear verification.

1) Inspect before changing

Run:

openclaw models status --probe --probe-provider openai-codex
openclaw plugins list --json

Read these files when needed:

• ~/.openclaw/openclaw.json
• ~/.openclaw/agents/<agentId>/agent/auth-profiles.json
• legacy: ~/.openclaw/agents/<agentId>/agent/auth.json

2) Use the right mental model

• models.providers in openclaw.json is not the source of OAuth secrets.
• OAuth/API secrets live in each agent auth-profiles.json.
• auth.profiles in openclaw.json is metadata/routing only.
• Running onboarding twice can overwrite openai-codex:default instead of creating a second profile.

3) Add a second Codex profile safely

If second login exists in another agent, copy that OAuth entry into target agent as openai-codex:alt2.

Then ensure in openclaw.json:

• auth.profiles.openai-codex:alt2 = { provider: "openai-codex", mode: "oauth" }
• auth.order.openai-codex = ["openai-codex:default", "openai-codex:alt2"] (or reverse)

Keep profile IDs explicit and stable (default, alt2, work, personal).

4) Enforce per-agent isolation

Pin an agent to one profile:

openclaw models auth order set --provider openai-codex --agent <agentId> <profileId>

Examples:

openclaw models auth order set --provider openai-codex --agent dae openai-codex:alt2
openclaw models auth order set --provider openai-codex --agent xiaoxiaogua openai-codex:alt2

If strict isolation is required, remove disallowed profile entries from that agent's auth-profiles.json.

5) Verify correctly

• Provider/profile health:

openclaw models status --agent <agentId> --probe --probe-provider openai-codex

• Current session actual profile (main chat): use session_status and read oauth (<profileId>).

Note: --probe may show multiple profiles as healthy; routing priority is controlled by auth.order and session pinning.

6) Troubleshooting quick map

• Unknown provider "openai-codex" from models auth login:
  • Provider login plugin path is unavailable in this runtime; use onboarding flow for Codex OAuth and then normalize profiles manually.
• Two agents show different accountId:
  • Usually intentional per-agent auth isolation, not corruption.
• PowerShell script policy blocks openclaw:
  • Use cmd /c openclaw ... on Windows.

7) Security hygiene

• Never paste full access/refresh/api keys into chats.
• If keys were exposed, rotate immediately.
• Keep default reserved for primary/main agent if requested; pin sub-agents to alternate profile IDs.