From 61273c072c2e901005f72fc865c11bdf1db773a1 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Sat, 7 Mar 2026 10:09:00 -0800
Subject: [PATCH] Docs: remove MDX-breaking secret markers

---
 docs/gateway/remote.md              | 4 ++--
 docs/providers/mistral.md           | 2 +-
 docs/start/wizard-cli-automation.md | 2 +-
 docs/tools/web.md                   | 4 ++--
 docs/vps.md                         | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/docs/gateway/remote.md b/docs/gateway/remote.md
index b5dd8c198e7..ea99f57c488 100644
--- a/docs/gateway/remote.md
+++ b/docs/gateway/remote.md
@@ -108,10 +108,10 @@ Gateway call/probe credential resolution now follows one shared contract:
 - Explicit credentials (`--token`, `--password`, or tool `gatewayToken`) always win.
 - Local mode defaults:
   - token: `OPENCLAW_GATEWAY_TOKEN` -> `gateway.auth.token` -> `gateway.remote.token`
-  - password: `OPENCLAW_GATEWAY_PASSWORD` -> `gateway.auth.password` -> `gateway.remote.password` <!-- pragma: allowlist secret -->
+  - password: `OPENCLAW_GATEWAY_PASSWORD` -> `gateway.auth.password` -> `gateway.remote.password`
 - Remote mode defaults:
   - token: `gateway.remote.token` -> `OPENCLAW_GATEWAY_TOKEN` -> `gateway.auth.token`
-  - password: `OPENCLAW_GATEWAY_PASSWORD` -> `gateway.remote.password` -> `gateway.auth.password` <!-- pragma: allowlist secret -->
+  - password: `OPENCLAW_GATEWAY_PASSWORD` -> `gateway.remote.password` -> `gateway.auth.password`
 - Remote probe/status token checks are strict by default: they use `gateway.remote.token` only (no local token fallback) when targeting remote mode.
 - Legacy `CLAWDBOT_GATEWAY_*` env vars are only used by compatibility call paths; probe/status/auth resolution uses `OPENCLAW_GATEWAY_*` only.
 
diff --git a/docs/providers/mistral.md b/docs/providers/mistral.md
index ad1b794f041..44e594abf21 100644
--- a/docs/providers/mistral.md
+++ b/docs/providers/mistral.md
@@ -24,7 +24,7 @@ openclaw onboard --mistral-api-key "$MISTRAL_API_KEY"
 
 ```json5
 {
-  env: { MISTRAL_API_KEY: "sk-..." }, // pragma: allowlist secret
+  env: { MISTRAL_API_KEY: "sk-..." },
   agents: { defaults: { model: { primary: "mistral/mistral-large-latest" } } },
 }
 ```
diff --git a/docs/start/wizard-cli-automation.md b/docs/start/wizard-cli-automation.md
index b60fd7c772e..14f4a9d5d32 100644
--- a/docs/start/wizard-cli-automation.md
+++ b/docs/start/wizard-cli-automation.md
@@ -152,7 +152,7 @@ openclaw onboard --non-interactive \
     Ref-mode variant:
 
     ```bash
-    export CUSTOM_API_KEY="your-key" # pragma: allowlist secret
+    export CUSTOM_API_KEY="your-key"
     openclaw onboard --non-interactive \
       --mode local \
       --auth-choice custom-api-key \
diff --git a/docs/tools/web.md b/docs/tools/web.md
index c004fea8262..c87638b8d86 100644
--- a/docs/tools/web.md
+++ b/docs/tools/web.md
@@ -104,7 +104,7 @@ Brave provides paid plans; check the Brave API portal for the current limits and
       search: {
         enabled: true,
         provider: "brave",
-        apiKey: "BSA...", // pragma: allowlist secret; optional if BRAVE_API_KEY is set
+        apiKey: "BSA...", // optional if BRAVE_API_KEY is set
       },
     },
   },
@@ -132,7 +132,7 @@ which returns AI-synthesized answers backed by live Google Search results with c
         provider: "gemini",
         gemini: {
           // API key (optional if GEMINI_API_KEY is set)
-          apiKey: "AIza...", // pragma: allowlist secret
+          apiKey: "AIza...",
           // Model (defaults to "gemini-2.5-flash")
           model: "gemini-2.5-flash",
         },
diff --git a/docs/vps.md b/docs/vps.md
index 183a126755f..66c2fdaf93f 100644
--- a/docs/vps.md
+++ b/docs/vps.md
@@ -58,7 +58,7 @@ If CLI commands feel slow on low-power VMs (or ARM hosts), enable Node's module
 
 ```bash
 grep -q 'NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache' ~/.bashrc || cat >> ~/.bashrc <<'EOF'
-export NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache # pragma: allowlist secret
+export NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache
 mkdir -p /var/tmp/openclaw-compile-cache
 export OPENCLAW_NO_RESPAWN=1
 EOF