Files
openclaw/docs/reference/secretref-user-supplied-credentials-matrix.json
Peter Steinberger edecdbd05e refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)
* refactor(config): consolidate media model lists

* refactor(config): unify memory configuration

* refactor(config): consolidate TTS ownership

* refactor(config): move typing policy to agents

* refactor(config): retire product-level config surfaces

* refactor(config): share scoped tool policy type

* chore(config): refresh generated baselines

* fix(config): honor agent typing overrides

* fix(config): migrate sibling config consumers

* refactor(infra): keep base64url decoder private

* fix(config): strip invalid legacy TTS values

* chore(config): refresh rebased baseline hash

* fix(doctor): route legacy messages.tts.realtime voice to talk during tts move

* refactor(config): polish final layout names

* refactor(config): freeze retired tuning defaults

* feat(config): add fast mode default symmetry

* refactor(config): key agent entries by id

* docs(config): update final layout reference

* test(config): cover final layout migrations

* chore(config): refresh final layout baselines

* fix(config): align final layout runtime readers

* fix(config): align remaining readers

* fix(config): stabilize final layout migrations

* fix(config): finalize config projection proof

* fix(config): address final layout review

* docs(release): preserve historical config names

* fix(config): complete keyed agent migration

* fix(config): close final migration gaps

* fix(config): finish full-branch review

* fix(config): complete runtime secret detection

* fix(config): close final review findings

* fix(config): finish canonical docs and heartbeat migration

* fix(config): integrate latest main after rebase

* refactor(env): isolate test-only controls

* refactor(env): isolate build and development controls

* refactor(env): collapse process identity indirection

* refactor(env): remove duplicate config and temp aliases

* docs(env): define the operator-facing allowlist

* ci(env): ratchet production variable count

* fix(env): remove stale provider helper import

* fix(env): make ratchet sorting explicit

* test(env): keep test seam in dead-code audit

* test(env): cover ratchet growth and boundary; document surface budgets

* docs(config): document tier-eval consolidations

* docs(config): clarify speech preference ownership

* test(memory): align retired tuning fixtures

* refactor(memory): freeze engine heuristics

* refactor(config): apply tier-eval tranche

* refactor(tts): move persona shaping to providers

* refactor(compaction): move prompt policy to providers

* test(config): align hookified prompt fixtures

* chore(deadcode): classify test-only exports

* chore(github): remove unused spawn helper

* chore(deadcode): classify queue diagnostics

* chore(deadcode): remove unused lane snapshot export

* chore(plugin-sdk): ratchet consolidated surface

* fix(config): integrate latest main after rebase
2026-07-21 20:28:43 -07:00

729 lines
22 KiB
JSON

{
"version": 1,
"matrixId": "strictly-user-supplied-credentials",
"pathSyntax": "Dot path with \"*\" for map keys and \"[]\" for arrays.",
"scope": "Credentials that are strictly user-supplied and not minted/rotated by OpenClaw runtime.",
"excludedMutableOrRuntimeManaged": [
"hooks.token",
"hooks.gmail.pushToken",
"hooks.mappings[].sessionKey",
"auth-profiles.oauth.*",
"channels.discord.accounts.*.threadBindings.webhookToken",
"channels.discord.threadBindings.webhookToken",
"channels.whatsapp.accounts.*.creds.json",
"channels.whatsapp.creds.json"
],
"entries": [
{
"id": "agents.entries.*.memory.search.remote.apiKey",
"configFile": "openclaw.json",
"path": "agents.entries.*.memory.search.remote.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "agents.entries.*.tts.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "agents.entries.*.tts.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "auth-profiles.api_key.key",
"configFile": "auth-profiles.json",
"path": "profiles.*.key",
"refPath": "profiles.*.keyRef",
"when": {
"type": "api_key"
},
"secretShape": "sibling_ref",
"optIn": true,
"notes": "Compatibility exception: sibling ref field remains canonical."
},
{
"id": "auth-profiles.token.token",
"configFile": "auth-profiles.json",
"path": "profiles.*.token",
"refPath": "profiles.*.tokenRef",
"when": {
"type": "token"
},
"secretShape": "sibling_ref",
"optIn": true,
"notes": "Compatibility exception: sibling ref field remains canonical."
},
{
"id": "channels.clickclack.accounts.*.token",
"configFile": "openclaw.json",
"path": "channels.clickclack.accounts.*.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.clickclack.token",
"configFile": "openclaw.json",
"path": "channels.clickclack.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.accounts.*.pluralkit.token",
"configFile": "openclaw.json",
"path": "channels.discord.accounts.*.pluralkit.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.accounts.*.token",
"configFile": "openclaw.json",
"path": "channels.discord.accounts.*.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.accounts.*.voice.tts.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "channels.discord.accounts.*.voice.tts.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.pluralkit.token",
"configFile": "openclaw.json",
"path": "channels.discord.pluralkit.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.token",
"configFile": "openclaw.json",
"path": "channels.discord.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.voice.tts.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "channels.discord.voice.tts.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.accounts.*.appSecret",
"configFile": "openclaw.json",
"path": "channels.feishu.accounts.*.appSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.accounts.*.encryptKey",
"configFile": "openclaw.json",
"path": "channels.feishu.accounts.*.encryptKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.accounts.*.verificationToken",
"configFile": "openclaw.json",
"path": "channels.feishu.accounts.*.verificationToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.appSecret",
"configFile": "openclaw.json",
"path": "channels.feishu.appSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.encryptKey",
"configFile": "openclaw.json",
"path": "channels.feishu.encryptKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.verificationToken",
"configFile": "openclaw.json",
"path": "channels.feishu.verificationToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.googlechat.accounts.*.serviceAccount",
"configFile": "openclaw.json",
"path": "channels.googlechat.accounts.*.serviceAccount",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.googlechat.serviceAccount",
"configFile": "openclaw.json",
"path": "channels.googlechat.serviceAccount",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.irc.accounts.*.nickserv.password",
"configFile": "openclaw.json",
"path": "channels.irc.accounts.*.nickserv.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.irc.accounts.*.password",
"configFile": "openclaw.json",
"path": "channels.irc.accounts.*.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.irc.nickserv.password",
"configFile": "openclaw.json",
"path": "channels.irc.nickserv.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.irc.password",
"configFile": "openclaw.json",
"path": "channels.irc.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.matrix.accessToken",
"configFile": "openclaw.json",
"path": "channels.matrix.accessToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.matrix.accounts.*.accessToken",
"configFile": "openclaw.json",
"path": "channels.matrix.accounts.*.accessToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.matrix.accounts.*.password",
"configFile": "openclaw.json",
"path": "channels.matrix.accounts.*.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.matrix.password",
"configFile": "openclaw.json",
"path": "channels.matrix.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.mattermost.accounts.*.botToken",
"configFile": "openclaw.json",
"path": "channels.mattermost.accounts.*.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.mattermost.botToken",
"configFile": "openclaw.json",
"path": "channels.mattermost.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.msteams.appPassword",
"configFile": "openclaw.json",
"path": "channels.msteams.appPassword",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.nextcloud-talk.accounts.*.apiPassword",
"configFile": "openclaw.json",
"path": "channels.nextcloud-talk.accounts.*.apiPassword",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.nextcloud-talk.accounts.*.botSecret",
"configFile": "openclaw.json",
"path": "channels.nextcloud-talk.accounts.*.botSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.nextcloud-talk.apiPassword",
"configFile": "openclaw.json",
"path": "channels.nextcloud-talk.apiPassword",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.nextcloud-talk.botSecret",
"configFile": "openclaw.json",
"path": "channels.nextcloud-talk.botSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.qqbot.accounts.*.clientSecret",
"configFile": "openclaw.json",
"path": "channels.qqbot.accounts.*.clientSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.qqbot.clientSecret",
"configFile": "openclaw.json",
"path": "channels.qqbot.clientSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.accounts.*.appToken",
"configFile": "openclaw.json",
"path": "channels.slack.accounts.*.appToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.accounts.*.botToken",
"configFile": "openclaw.json",
"path": "channels.slack.accounts.*.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.accounts.*.relay.authToken",
"configFile": "openclaw.json",
"path": "channels.slack.accounts.*.relay.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.accounts.*.signingSecret",
"configFile": "openclaw.json",
"path": "channels.slack.accounts.*.signingSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.accounts.*.userToken",
"configFile": "openclaw.json",
"path": "channels.slack.accounts.*.userToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.appToken",
"configFile": "openclaw.json",
"path": "channels.slack.appToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.botToken",
"configFile": "openclaw.json",
"path": "channels.slack.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.relay.authToken",
"configFile": "openclaw.json",
"path": "channels.slack.relay.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.signingSecret",
"configFile": "openclaw.json",
"path": "channels.slack.signingSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.userToken",
"configFile": "openclaw.json",
"path": "channels.slack.userToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.sms.accounts.*.authToken",
"configFile": "openclaw.json",
"path": "channels.sms.accounts.*.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.sms.authToken",
"configFile": "openclaw.json",
"path": "channels.sms.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.telegram.accounts.*.botToken",
"configFile": "openclaw.json",
"path": "channels.telegram.accounts.*.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.telegram.accounts.*.webhookSecret",
"configFile": "openclaw.json",
"path": "channels.telegram.accounts.*.webhookSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.telegram.botToken",
"configFile": "openclaw.json",
"path": "channels.telegram.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.telegram.webhookSecret",
"configFile": "openclaw.json",
"path": "channels.telegram.webhookSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.zalo.accounts.*.botToken",
"configFile": "openclaw.json",
"path": "channels.zalo.accounts.*.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.zalo.accounts.*.webhookSecret",
"configFile": "openclaw.json",
"path": "channels.zalo.accounts.*.webhookSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.zalo.botToken",
"configFile": "openclaw.json",
"path": "channels.zalo.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.zalo.webhookSecret",
"configFile": "openclaw.json",
"path": "channels.zalo.webhookSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "cron.webhookToken",
"configFile": "openclaw.json",
"path": "cron.webhookToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "gateway.auth.password",
"configFile": "openclaw.json",
"path": "gateway.auth.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "gateway.auth.token",
"configFile": "openclaw.json",
"path": "gateway.auth.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "gateway.remote.password",
"configFile": "openclaw.json",
"path": "gateway.remote.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "gateway.remote.token",
"configFile": "openclaw.json",
"path": "gateway.remote.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "memory.search.remote.apiKey",
"configFile": "openclaw.json",
"path": "memory.search.remote.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "models.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.headers.*",
"configFile": "openclaw.json",
"path": "models.providers.*.headers.*",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.auth.token",
"configFile": "openclaw.json",
"path": "models.providers.*.request.auth.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.auth.value",
"configFile": "openclaw.json",
"path": "models.providers.*.request.auth.value",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.headers.*",
"configFile": "openclaw.json",
"path": "models.providers.*.request.headers.*",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.proxy.tls.ca",
"configFile": "openclaw.json",
"path": "models.providers.*.request.proxy.tls.ca",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.proxy.tls.cert",
"configFile": "openclaw.json",
"path": "models.providers.*.request.proxy.tls.cert",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.proxy.tls.key",
"configFile": "openclaw.json",
"path": "models.providers.*.request.proxy.tls.key",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.proxy.tls.passphrase",
"configFile": "openclaw.json",
"path": "models.providers.*.request.proxy.tls.passphrase",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.tls.ca",
"configFile": "openclaw.json",
"path": "models.providers.*.request.tls.ca",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.tls.cert",
"configFile": "openclaw.json",
"path": "models.providers.*.request.tls.cert",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.tls.key",
"configFile": "openclaw.json",
"path": "models.providers.*.request.tls.key",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.tls.passphrase",
"configFile": "openclaw.json",
"path": "models.providers.*.request.tls.passphrase",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.acpx.config.mcpServers.*.env.*",
"configFile": "openclaw.json",
"path": "plugins.entries.acpx.config.mcpServers.*.env.*",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.brave.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.brave.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.codex.config.appServer.authToken",
"configFile": "openclaw.json",
"path": "plugins.entries.codex.config.appServer.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.codex.config.appServer.headers.*",
"configFile": "openclaw.json",
"path": "plugins.entries.codex.config.appServer.headers.*",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.exa.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.exa.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.firecrawl.config.webFetch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.firecrawl.config.webFetch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.firecrawl.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.firecrawl.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.google-meet.config.realtime.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.google-meet.config.realtime.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.google.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.google.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.minimax.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.minimax.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.moonshot.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.moonshot.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.parallel.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.parallel.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.perplexity.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.perplexity.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.tavily.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.tavily.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.voice-call.config.realtime.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.voice-call.config.realtime.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.voice-call.config.streaming.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.voice-call.config.streaming.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.voice-call.config.tts.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.voice-call.config.tts.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.voice-call.config.twilio.authToken",
"configFile": "openclaw.json",
"path": "plugins.entries.voice-call.config.twilio.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.webhooks.config.routes.*.secret",
"configFile": "openclaw.json",
"path": "plugins.entries.webhooks.config.routes.*.secret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.xai.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.xai.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "skills.entries.*.apiKey",
"configFile": "openclaw.json",
"path": "skills.entries.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "talk.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "talk.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "talk.realtime.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "talk.realtime.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "tts.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "tts.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
}
]
}