OpenClaw Custom Providers Can Break After pi-ai 0.63+: Why You Get ‘No API key for provider’ Even When `apiKey` Is Set

A newly reported OpenClaw regression can make custom OpenAI-compatible providers fail immediately, even when the provider API key is clearly configured.

The visible error is blunt:

Error: No API key for provider: <name>

But the report says the key is not actually missing from config. It is loaded into auth storage and can still be resolved earlier in the chain. The failure happens later, when the request reaches the streaming layer.

Sources:

OpenClaw issue: openclaw/openclaw#61429
Related upstream report: badlogic/pi-mono#2847

What is breaking

According to the issue, this affects setups where you define a custom provider inside models.providers.<name> with fields such as:

baseUrl
apiKey
api: "openai-completions"
one or more custom model ids

A simplified example from the report looks like this:

{
  "models": {
    "providers": {
      "my-proxy": {
        "baseUrl": "http://my-proxy/v1",
        "apiKey": "sk-my-key",
        "api": "openai-completions",
        "models": [{ "id": "my-model", "name": "my-model" }]
      }
    }
  },
  "agents": {
    "defaults": {
      "model": { "primary": "my-proxy/my-model" }
    }
  }
}

In the reported failure mode:

OpenClaw starts normally
the custom provider appears configured correctly
a request is sent to that model
the request fails at stream time with No API key for provider: my-proxy

That means this is not a simple startup-schema problem. It is a runtime auth handoff problem.

Why this is serious

This issue does not just affect a niche lab setup.

The impacted pattern includes exactly the kinds of deployments many teams use in production:

OpenAI-compatible proxy gateways
self-hosted model endpoints
corporate API gateways
custom routing layers that normalize multiple models behind one endpoint

If your stack depends on custom provider names, the report says the failure rate is effectively 100% for affected versions.

The practical result is ugly: after upgrading, your custom model path can go from fully working to completely non-functional, with every call failing before any tokens stream.

Why built-in providers may still work

One of the most important details in the report is that built-in providers such as:

anthropic
openai
google
groq

may remain unaffected.

Why? Because those provider names still have a fallback path through pi-ai’s built-in environment-variable lookup.

Custom provider names do not get that safety net. They rely on OpenClaw passing the resolved key through explicitly. If that callback path breaks, custom providers have no second route to recover the key.

The reported regression boundary

The issue claims this worked in versions using @mariozechner/pi-ai <= 0.55.x and broke after pi-ai 0.63.x.

The suspected upstream boundary is a pi-mono change that removed a global apiKeys map fallback. After that removal, custom providers reportedly need a getApiKey callback to be attached correctly to the agent/session path.

That explains the weird symptom pattern:

config still contains the key
auth storage still knows the key
model registry can still resolve the key
but the stream function still receives options.apiKey = undefined

From an operator perspective, that is exactly the kind of failure that feels irrational until you realize the break is in the handoff between auth resolution and streaming, not in config parsing itself.

How to confirm you hit this exact issue

You are likely seeing the same regression if most of the following are true:

you use a custom provider name rather than a built-in provider id
your provider is OpenAI-compatible and defined under models.providers
apiKey is present in config
requests fail only when the model is actually invoked
the error is No API key for provider: <custom-name>
built-in providers may still work while your custom one does not

That set of signals separates this issue from simpler mistakes such as:

typo in openclaw.json
missing environment variable
wrong base URL
invalid upstream credentials
model id mismatch

What the diagnostics reportedly show

The issue includes diagnostic logging that points to the same conclusion: the key exists before the stream layer.

The report says logs confirm all of the following:

provider normalization sees hasApiKey=true
auth resolution finds the custom key from models.json
runtime auth storage records the key
registry lookups can still report { ok: true, apiKey: <valid> }

Yet the downstream stream function still throws No API key for provider.

That is a strong signal that the failure is not in the operator’s config entry itself.

What to do right now

Until upstream fixes land, the safest operational response is to treat custom provider paths as version-sensitive.

1) Verify whether you upgraded onto a pi-ai 0.63+ chain

If your custom providers broke right after an OpenClaw upgrade, check whether your new build pulls in a pi-ai version at or above the reported regression boundary.

2) Test a built-in provider separately

If openai/... or another built-in provider still works while your custom provider fails, that is a strong clue that you hit the callback-path regression rather than a generic network or credential outage.

3) Avoid assuming “key present in config” means the stream path is healthy

For this bug, the important distinction is:

key exists in config
key exists in auth storage
but key still never reaches the actual stream call

So do not stop debugging just because your config file looks correct.

4) Prefer rollback or pinning if the custom provider path is business-critical

If custom providers sit on a revenue or production-critical workflow, the safest short-term move may be to pin or roll back to a version chain that predates the reported regression boundary, rather than trying to operate through repeated request failures.

The workaround mentioned in the report

The issue proposes a code-level workaround: after createAgentSession returns, inject a getApiKey callback onto the Agent instance so it can fetch the provider key from auth storage.

That is useful as a maintainer hint, but for most operators the real takeaway is simpler:

this looks like a code-path regression, not a documentation gap or a bad config habit.

If you are running packaged OpenClaw builds, you probably want an upstream fix or a version rollback—not manual patching inside the runtime.

What maintainers likely need to fix

Based on the report, the upstream repair direction is straightforward:

ensure the Agent/session path receives a getApiKey(provider) callback
preserve a valid auth handoff for custom providers at stream time
make sure custom provider names are not silently treated worse than built-in providers after auth resolution has already succeeded

The operator expectation here is reasonable: if models.providers.<name>.apiKey resolves successfully, the stream layer should not behave as if the key never existed.

Bottom line

If your OpenClaw setup uses custom OpenAI-compatible providers and they suddenly started failing with No API key for provider after an upgrade, do not assume the key is actually missing.

The current report points to a narrower and more damaging regression: the key may still be resolved correctly, but the runtime no longer passes it into the stream function for custom provider names.

If you arrived from the homepage, install guide, or migration guide

GA4 now places this custom provider API-key bug page inside the same small Chinese discovery cluster. Split it from installation failures, old Moltbot migration residue, and generic official-provider key errors before treating every “No API key” message as the same issue.

OpenClaw was just installed and every provider fails: use the Mac install guide or installation success checklist first, then confirm environment variables, Gateway, and Web UI are healthy.
A Moltbot migration left old provider names, config paths, or launch commands behind: use the 1-minute migration guide, then return here to inspect custom provider mapping.
Only custom providers fail with No API key for provider after Pi AI 0.63: stay on this page and check provider id, runtime order, custom key name, and the environment variables the runtime actually reads.

This routing separates “not installed”, “not migrated”, and “custom provider key not mapped” so the real API-key lookup issue stays on this page.

FAQ: the fastest operator checks after the first failure

How can operators quickly tell whether this is per-provider key resolution, not a dead provider or model outage?

Look for an asymmetric failure pattern.

This is much more likely a provider-key handoff regression when:

the custom provider fails immediately with No API key for provider
built-in providers such as openai or anthropic still work in the same deployment
config inspection still shows apiKey present under models.providers.<name>
the failure appears at invocation time, not during startup validation

That combination points to per-provider auth handoff, not a general upstream outage or dead model endpoint.

If you have confirmed this is a custom-provider key handoff regression, what should you check next?

Once you are reasonably sure the key is not missing from config and the custom provider only fails when the stream call starts, the next useful split is usually:

review Codex OAuth login succeeds but runtime still falls back to the default provider order so you can separate “provider auth succeeded but runtime routing never really landed” from “custom provider key never reached stream time”;
review Troubleshooting OpenClaw Agents: what to check first when tasks stall, tools do not return, or results look wrong to rule out stacked network, permission, tool, or message-path symptoms.

That split matters because operators often collapse two different failures into one: the provider selection looked right, but either the runtime never resolved to the intended provider, or it did resolve correctly and then lost the key before streaming.

Split custom-provider failures into three layers while on call

If a reader arrives from searches like No API key for provider, custom provider api key not found, or a Pi AI 0.63 upgrade failure, do not start by rotating secrets. Classify the incident into three layers first:

Configuration layer: confirm the provider id in agents.defaults.model.primary exactly matches the custom provider, including case and prefix. If this is wrong, runtime fixes will not help.
Handoff layer: the key exists in configuration, but stream startup still fails with No API key for provider. That matches this regression class more closely, so preserve logs and version numbers before changing more variables.
Rollback layer: built-in providers or the older pi-ai path work again. That makes the business prompt, network, and model less likely to be root causes and narrows the scope to the provider adapter contract.

This split turns a search visit into an operational decision: user configuration error, runtime key handoff failure, or an adapter contract change after upgrade.

Run four closeout checks after a fix, rollback, or upstream patch

Once you have changed the key handoff, rolled back, or received an upstream fix, do not stop at one successful request. Use this sequence instead:

Re-test the failing custom provider: make it complete at least one real streamed request, not just a config read.
Re-test built-in providers: confirm paths like openai and anthropic still work so the fix did not damage the standard route.
Verify the routing name: re-check that agents.defaults.model.primary still matches the custom provider id exactly.
Review the logs: make sure the old No API key for provider startup error no longer appears.

These four checks turn “it seems fixed” into “the custom-provider handoff is actually restored.”

Pre-flight checklist before changing provider settings

Use this checklist before editing a production agent or rotating keys:

Confirm the provider name in the UI matches the exact provider identifier used by the runtime.
Verify the API key is saved in the agent scope you are testing, not only in a global or older profile.
Restart only the affected agent after the key change, then send one low-cost request to prove the key path is live.
If the error still says No API key for provider, capture the provider id, model id, and runtime version in the incident note before changing more settings.

This keeps the fix focused on the missing key path instead of turning a provider-key incident into a broad configuration rewrite.

If troubleshooting or setup traffic lands here, separate missing-key symptoms from provider routing mistakes

GA4 now shows this page beside setup, troubleshooting, and other operator bug pages. That makes the page a recovery endpoint for people who may only see No API key for provider, not the real layer that dropped the key.

Before rotating secrets or editing runtime config, split the case this way:

Setup is not complete yet: verify the provider is selected, the key is present in the expected runtime environment, and the app was restarted after the change.
The key exists but the wrong provider is selected: check model-to-provider routing, custom provider aliases, and any fallback to Pi AI or default OpenAI paths.
Only custom-provider calls fail after an upgrade: treat it as the regression described here, preserve the failing model/provider pair, and avoid broad credential churn.

This keeps high-intent troubleshooting readers from burning time on secret rotation when the actual issue is provider selection or key handoff.

Exact searches this provider-key bug page should answer next

Use this section when the operator is not debugging every provider, but is stuck on a custom provider that already has a key configured and still fails with No API key for provider.

Pi AI custom provider no API key for provider: verify the provider id used by the runtime exactly matches the key name, including casing and aliases.
OpenClaw custom provider api key ignored after update: check whether the key moved from the old config path into the new credentials path, then restart only after confirming the loaded config.
No API key for provider even though env var is set: confirm the gateway process actually inherits the environment variable, not just the interactive shell.
Pi AI 0.63 no API key for provider after upgrade: verify whether the configured provider id still matches the key lookup path used by the runtime.
OpenClaw custom provider API key not found: inspect environment variables, provider aliases, and generated runtime config before rotating a working key.
fix custom provider no api key for provider OpenClaw: reproduce with the smallest custom provider call, then compare pre-upgrade and post-upgrade provider names.

Sources

Do not restart everything or rotate keys first. The fastest path is a small matrix: on the same OpenClaw version and the same host, run one built-in provider and one custom provider.

Built-in provider works, custom provider fails: suspect the custom provider getApiKey handoff path first, not a generic network or model-provider outage.
Both built-in and custom providers fail: go back to environment variables, proxy, firewall, upstream account quota, and Gateway logs before applying the pi-ai 0.63 regression explanation.
Only one custom provider fails: compare provider id, model id, baseUrl, key name, and the exact config file read by the running process.

What evidence should you keep before recovery?

If this path carries production work, keep at least these four pieces of evidence before recovery so you can verify whether rollback or pinning actually fixed it:

The provider id and model id from the failing request.
Current OpenClaw, pi-ai, deployment image, or lockfile version.
Side-by-side results for one built-in provider and one custom provider.
The log fragment showing that the key resolved earlier but the stream layer still failed.

This avoids a false fix where rotating a key merely coincides with cache refresh. The real recovery standard is not that the error disappears once, but that the same custom provider path completes multiple streaming responses on the intended version chain.