- CLI backends: keep versioned OAuth identity matches reusable when auth profile ids rotate, so Claude CLI sessions do not reset and lose continuity during same-account OAuth refresh/profile alias changes. Fixes #78541.

- Model providers: normalize APNG sniffed PNG uploads, preserve Gemini 3 tool-call thought-signature replay with documented fallback signatures, accept legacy `__env__:VAR` custom-provider keys, and repair snake_case tool-call transcript sanitization. Fixes #51881, #48915, #77566, and #42858.

- Telegram/models: parse provider ids containing dots in `/models` callback buttons so `hf.co` model lists render as inline keyboard buttons. Fixes #38745.

- Auth profiles/Bedrock: accept persisted `type: "aws-sdk"` auth profiles so EC2/IMDS and shared AWS credential-chain Bedrock setups are not dropped as `invalid_type`. Fixes #69708.

- Amazon Bedrock: refresh shared AWS profile/config file credentials before Bedrock model, discovery, and embedding requests so long-running Gateway processes pick up renewed profile credentials without restart. Fixes #77551.

- Amazon Bedrock: treat named `aws-sdk` auth profiles as config routing metadata instead of stored credentials, and let `doctor --fix` move legacy markers out of `auth-profiles.json`. Fixes #69708.

- Anthropic: reject uppercase provider-prefixed forward-compat model ids locally instead of sending malformed dynamic ids upstream. Fixes #73715.

- OpenAI/embeddings: pass configured output dimensionality through single and batched embedding requests so memory embedding indexes can request smaller vectors. Fixes #55126.

- CLI/infer: normalize HEIC/HEIF image files to JPEG before model-run requests, avoiding providers that reject Apple image container formats. Fixes #50081.

Non-portable profiles remain available through read-through inheritance unless

the target agent signs in separately and creates its own local profile.

## Config-only auth routes

`auth.profiles` entries with `mode: "aws-sdk"` are routing metadata, not stored

credentials. They are valid when the target provider uses

`models.providers.<id>.auth: "aws-sdk"` or the built-in Amazon Bedrock default

AWS SDK route. These profile ids may appear in `auth.order` and session

overrides even when no matching entry exists in `auth-profiles.json`.

Do not write `type: "aws-sdk"` into `auth-profiles.json`. If a legacy install

has such a marker, `openclaw doctor --fix` moves it to `auth.profiles` and

removes the marker from the credential store.

## Explicit auth order filtering

- When `auth.order.<provider>` or the auth-store order override is set for a

OpenClaw expects the canonical `version` + `profiles` shape at runtime. If an older install still has a flat file such as `{ "openrouter": { "apiKey": "..." } }`, run `openclaw doctor --fix` to rewrite it as an `openrouter:default` API-key profile; doctor keeps a `.legacy-flat.*.bak` copy beside the original. Endpoint details such as `baseUrl`, `api`, model ids, headers, and timeouts belong under `models.providers.<id>` in `openclaw.json` or `models.json`, not in `auth-profiles.json`.

External auth routes such as Bedrock `auth: "aws-sdk"` are also not credentials. If you want a named Bedrock route, put `auth.profiles.<id>.mode: "aws-sdk"` in `openclaw.json`; do not write `type: "aws-sdk"` into `auth-profiles.json`. `openclaw doctor --fix` moves legacy AWS SDK markers from the credential store into config metadata.

Auth profile refs are also supported for static credentials:

- `api_key` credentials can use `keyRef: { source, provider, id }`

type AuthProfileHealth = {

profileId: string;

provider: string;

type: "oauth" | "token" | "api_key" | "aws-sdk";

type: "oauth" | "token" | "api_key";

status: AuthProfileHealthStatus;

reasonCode?: AuthCredentialReasonCode;

expiresAt?: number;

};

}

if (healthCredential.type === "aws-sdk") {

return {

profileId,

provider,

type: "aws-sdk",

status: "static",

source,

label,

};

}

if (healthCredential.type === "token") {

const eligibility = evaluateStoredCredentialEligibility({

credential: healthCredential,

}

});

it("accepts aws-sdk auth profiles without static credential material (#69708)", () => {

withTempAgentDir("openclaw-auth-aws-sdk-", (agentDir) => {

writeAuthProfileStore(agentDir, {

"amazon-bedrock:default": {

type: "aws-sdk",

provider: "amazon-bedrock",

createdAt: "2026-03-15T10:00:00.000Z",

},

});

const profile = loadAuthProfile(agentDir, "amazon-bedrock:default");

expect(profile).toMatchObject({

type: "aws-sdk",

provider: "amazon-bedrock",

});

});

});

it.each([

{

name: "migrates SecretRef object in `key` to `keyRef` and clears `key`",

const store = ANTHROPIC_STORE;

const cfg = ANTHROPIC_CFG;

it("keeps config-only aws-sdk profiles for aws-sdk providers", () => {

const order = resolveAuthProfileOrder({

cfg: {

models: {

providers: {

"amazon-bedrock": {

auth: "aws-sdk",

baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",

api: "bedrock-converse-stream",

models: [],

},

},

},

auth: {

order: {

"amazon-bedrock": ["amazon-bedrock:default"],

},

profiles: {

"amazon-bedrock:default": {

provider: "amazon-bedrock",

mode: "aws-sdk",

},

},

},

},

store: { version: 1, profiles: {} },

provider: "amazon-bedrock",

});

expect(order).toEqual(["amazon-bedrock:default"]);

});

it("rejects config-only aws-sdk profiles for non aws-sdk providers", () => {

const order = resolveAuthProfileOrder({

cfg: {

models: {

providers: {

anthropic: {

auth: "api-key",

baseUrl: "https://api.anthropic.com",

api: "anthropic-messages",

models: [],

},

},

},

auth: {

profiles: {

"anthropic:aws": {

provider: "anthropic",

mode: "aws-sdk",

},

},

},

},

store: { version: 1, profiles: {} },

provider: "anthropic",

});

expect(order).toEqual([]);

});

function resolveWithAnthropicOrderAndUsage(params: {

orderSource: "store" | "config";

usageStats: NonNullable<AuthProfileStore["usageStats"]>;

type ExternalCliAuthDiscovery,

} from "./auth-profiles/external-cli-discovery.js";

export { resolveApiKeyForProfile } from "./auth-profiles/oauth.js";

export { resolveAuthProfileEligibility, resolveAuthProfileOrder } from "./auth-profiles/order.js";

export {

isConfiguredAwsSdkAuthProfileForProvider,

resolveAuthProfileEligibility,

resolveAuthProfileOrder,

} from "./auth-profiles/order.js";

export {

resolveAuthStatePathForDisplay,

resolveAuthStorePathForDisplay,

return { eligible: true, reasonCode: "ok" };

}

if (credential.type === "aws-sdk") {

return { eligible: true, reasonCode: "ok" };

}

if (credential.type === "token") {

const hasToken = hasConfiguredSecretString(credential.token);

const hasTokenRef = hasConfiguredSecretRef(credential.tokenRef);

cfg?: OpenClawConfig;

profileId: string;

provider: string;

mode: "api_key" | "aws-sdk" | "token" | "oauth";

mode: "api_key" | "token" | "oauth";

allowOAuthTokenCompatibility?: boolean;

}): boolean {

const profileConfig = params.cfg?.auth?.profiles?.[params.profileId];

}

return buildApiKeyProfileResult({ apiKey: key, provider: cred.provider, email: cred.email });

}

if (cred.type === "aws-sdk") {

return null;

}

if (cred.type === "token") {

const expiryState = resolveTokenExpiryState(cred.expires);

if (expiryState === "expired" || expiryState === "invalid_expires") {

reasonCode: AuthProfileEligibilityReasonCode;

};

function resolveProviderAuthMode(

cfg: OpenClawConfig | undefined,

provider: string,

): string | undefined {

const providers = cfg?.models?.providers;

if (!providers) {

return undefined;

}

const entry = findNormalizedProviderValue(providers, provider);

const auth = entry?.auth;

return typeof auth === "string" ? auth : undefined;

}

function providerAllowsAwsSdkAuth(cfg: OpenClawConfig | undefined, provider: string): boolean {

const authMode = resolveProviderAuthMode(cfg, provider);

return (

authMode === "aws-sdk" ||

(authMode === undefined && normalizeProviderId(provider) === "amazon-bedrock")

);

}

export function isConfiguredAwsSdkAuthProfileForProvider(params: {

cfg?: OpenClawConfig;

provider: string;

profileId: string;

}): boolean {

const profileConfig = params.cfg?.auth?.profiles?.[params.profileId];

if (!profileConfig || profileConfig.mode !== "aws-sdk") {

return false;

}

const providerAuthKey = resolveProviderIdForAuth(params.provider, { config: params.cfg });

if (

resolveProviderIdForAuth(profileConfig.provider, { config: params.cfg }) !== providerAuthKey

) {

return false;

}

return providerAllowsAwsSdkAuth(params.cfg, params.provider);

}

export function resolveAuthProfileEligibility(params: {

cfg?: OpenClawConfig;

store: AuthProfileStore;

const providerAuthKey = resolveProviderIdForAuth(params.provider, { config: params.cfg });

const cred = params.store.profiles[params.profileId];

if (!cred) {

if (

isConfiguredAwsSdkAuthProfileForProvider({

cfg: params.cfg,

provider: params.provider,

profileId: params.profileId,

})

) {

return { eligible: true, reasonCode: "ok" };

}

return { eligible: false, reasonCode: "profile_missing" };

}

if (resolveProviderIdForAuth(cred.provider, { config: params.cfg }) !== providerAuthKey) {