Files
openclaw/docs/reference/secretref-user-supplied-credentials-matrix.json
Peter SteinbergerandGitHub c7e7ac2728 refactor: remove expired plugin compatibility surfaces (#111451)
* docs(secrets): remove retired web credential paths

* refactor(web): remove retired provider compatibility paths

* refactor(providers): delete retired compatibility routes

* refactor(secrets): remove retired credential aliases

* refactor(plugin-sdk): delete retired compatibility surfaces

* docs(plugin-sdk): remove retired migration guidance

* chore(plugin-sdk): refresh rebased surface budgets

* chore(plugin-sdk): refresh API removal baseline

* refactor(compat): migrate retired internal callers

* chore(plugin-sdk): refresh current-main baselines

* test(config): migrate plugin-owned secret assertions

* test(gateway): narrow plugin secret refs

* fix(plugin-sdk): preserve private boundary type identity

* chore(compat): remove stale sweep references

* chore(lint): lower max-lines budget

* refactor(secrets): remove unused web helper

* build(plugin-sdk): drop removed compat entries

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): use Linux API baseline hash

* fix(plugin-sdk): preserve private bundled build entries

* fix(plugin-sdk): package private runtime facades

* fix(plugins): preserve external credential contracts
2026-07-19 11:04:48 -07:00

734 lines
22 KiB
JSON

{
"version": 1,
"matrixId": "strictly-user-supplied-credentials",
"pathSyntax": "Dot path with \"*\" for map keys and \"[]\" for arrays.",
"scope": "Credentials that are strictly user-supplied and not minted/rotated by OpenClaw runtime.",
"excludedMutableOrRuntimeManaged": [
"commands.ownerDisplaySecret",
"hooks.token",
"hooks.gmail.pushToken",
"hooks.mappings[].sessionKey",
"auth-profiles.oauth.*",
"channels.discord.accounts.*.threadBindings.webhookToken",
"channels.discord.threadBindings.webhookToken",
"channels.whatsapp.accounts.*.creds.json",
"channels.whatsapp.creds.json"
],
"entries": [
{
"id": "agents.defaults.memorySearch.remote.apiKey",
"configFile": "openclaw.json",
"path": "agents.defaults.memorySearch.remote.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "agents.list[].memorySearch.remote.apiKey",
"configFile": "openclaw.json",
"path": "agents.list[].memorySearch.remote.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "agents.list[].tts.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "agents.list[].tts.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "auth-profiles.api_key.key",
"configFile": "auth-profiles.json",
"path": "profiles.*.key",
"refPath": "profiles.*.keyRef",
"when": {
"type": "api_key"
},
"secretShape": "sibling_ref",
"optIn": true,
"notes": "Compatibility exception: sibling ref field remains canonical."
},
{
"id": "auth-profiles.token.token",
"configFile": "auth-profiles.json",
"path": "profiles.*.token",
"refPath": "profiles.*.tokenRef",
"when": {
"type": "token"
},
"secretShape": "sibling_ref",
"optIn": true,
"notes": "Compatibility exception: sibling ref field remains canonical."
},
{
"id": "channels.clickclack.accounts.*.token",
"configFile": "openclaw.json",
"path": "channels.clickclack.accounts.*.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.clickclack.token",
"configFile": "openclaw.json",
"path": "channels.clickclack.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.accounts.*.pluralkit.token",
"configFile": "openclaw.json",
"path": "channels.discord.accounts.*.pluralkit.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.accounts.*.token",
"configFile": "openclaw.json",
"path": "channels.discord.accounts.*.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.accounts.*.voice.tts.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "channels.discord.accounts.*.voice.tts.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.pluralkit.token",
"configFile": "openclaw.json",
"path": "channels.discord.pluralkit.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.token",
"configFile": "openclaw.json",
"path": "channels.discord.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.discord.voice.tts.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "channels.discord.voice.tts.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.accounts.*.appSecret",
"configFile": "openclaw.json",
"path": "channels.feishu.accounts.*.appSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.accounts.*.encryptKey",
"configFile": "openclaw.json",
"path": "channels.feishu.accounts.*.encryptKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.accounts.*.verificationToken",
"configFile": "openclaw.json",
"path": "channels.feishu.accounts.*.verificationToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.appSecret",
"configFile": "openclaw.json",
"path": "channels.feishu.appSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.encryptKey",
"configFile": "openclaw.json",
"path": "channels.feishu.encryptKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.feishu.verificationToken",
"configFile": "openclaw.json",
"path": "channels.feishu.verificationToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.googlechat.accounts.*.serviceAccount",
"configFile": "openclaw.json",
"path": "channels.googlechat.accounts.*.serviceAccount",
"refPath": "channels.googlechat.accounts.*.serviceAccountRef",
"secretShape": "sibling_ref",
"optIn": true,
"notes": "Compatibility exception: sibling ref field remains canonical."
},
{
"id": "channels.googlechat.serviceAccount",
"configFile": "openclaw.json",
"path": "channels.googlechat.serviceAccount",
"refPath": "channels.googlechat.serviceAccountRef",
"secretShape": "sibling_ref",
"optIn": true,
"notes": "Compatibility exception: sibling ref field remains canonical."
},
{
"id": "channels.irc.accounts.*.nickserv.password",
"configFile": "openclaw.json",
"path": "channels.irc.accounts.*.nickserv.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.irc.accounts.*.password",
"configFile": "openclaw.json",
"path": "channels.irc.accounts.*.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.irc.nickserv.password",
"configFile": "openclaw.json",
"path": "channels.irc.nickserv.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.irc.password",
"configFile": "openclaw.json",
"path": "channels.irc.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.matrix.accessToken",
"configFile": "openclaw.json",
"path": "channels.matrix.accessToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.matrix.accounts.*.accessToken",
"configFile": "openclaw.json",
"path": "channels.matrix.accounts.*.accessToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.matrix.accounts.*.password",
"configFile": "openclaw.json",
"path": "channels.matrix.accounts.*.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.matrix.password",
"configFile": "openclaw.json",
"path": "channels.matrix.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.mattermost.accounts.*.botToken",
"configFile": "openclaw.json",
"path": "channels.mattermost.accounts.*.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.mattermost.botToken",
"configFile": "openclaw.json",
"path": "channels.mattermost.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.msteams.appPassword",
"configFile": "openclaw.json",
"path": "channels.msteams.appPassword",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.nextcloud-talk.accounts.*.apiPassword",
"configFile": "openclaw.json",
"path": "channels.nextcloud-talk.accounts.*.apiPassword",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.nextcloud-talk.accounts.*.botSecret",
"configFile": "openclaw.json",
"path": "channels.nextcloud-talk.accounts.*.botSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.nextcloud-talk.apiPassword",
"configFile": "openclaw.json",
"path": "channels.nextcloud-talk.apiPassword",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.nextcloud-talk.botSecret",
"configFile": "openclaw.json",
"path": "channels.nextcloud-talk.botSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.qqbot.accounts.*.clientSecret",
"configFile": "openclaw.json",
"path": "channels.qqbot.accounts.*.clientSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.qqbot.clientSecret",
"configFile": "openclaw.json",
"path": "channels.qqbot.clientSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.accounts.*.appToken",
"configFile": "openclaw.json",
"path": "channels.slack.accounts.*.appToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.accounts.*.botToken",
"configFile": "openclaw.json",
"path": "channels.slack.accounts.*.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.accounts.*.relay.authToken",
"configFile": "openclaw.json",
"path": "channels.slack.accounts.*.relay.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.accounts.*.signingSecret",
"configFile": "openclaw.json",
"path": "channels.slack.accounts.*.signingSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.accounts.*.userToken",
"configFile": "openclaw.json",
"path": "channels.slack.accounts.*.userToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.appToken",
"configFile": "openclaw.json",
"path": "channels.slack.appToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.botToken",
"configFile": "openclaw.json",
"path": "channels.slack.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.relay.authToken",
"configFile": "openclaw.json",
"path": "channels.slack.relay.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.signingSecret",
"configFile": "openclaw.json",
"path": "channels.slack.signingSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.slack.userToken",
"configFile": "openclaw.json",
"path": "channels.slack.userToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.sms.accounts.*.authToken",
"configFile": "openclaw.json",
"path": "channels.sms.accounts.*.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.sms.authToken",
"configFile": "openclaw.json",
"path": "channels.sms.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.telegram.accounts.*.botToken",
"configFile": "openclaw.json",
"path": "channels.telegram.accounts.*.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.telegram.accounts.*.webhookSecret",
"configFile": "openclaw.json",
"path": "channels.telegram.accounts.*.webhookSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.telegram.botToken",
"configFile": "openclaw.json",
"path": "channels.telegram.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.telegram.webhookSecret",
"configFile": "openclaw.json",
"path": "channels.telegram.webhookSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.zalo.accounts.*.botToken",
"configFile": "openclaw.json",
"path": "channels.zalo.accounts.*.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.zalo.accounts.*.webhookSecret",
"configFile": "openclaw.json",
"path": "channels.zalo.accounts.*.webhookSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.zalo.botToken",
"configFile": "openclaw.json",
"path": "channels.zalo.botToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "channels.zalo.webhookSecret",
"configFile": "openclaw.json",
"path": "channels.zalo.webhookSecret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "cron.webhookToken",
"configFile": "openclaw.json",
"path": "cron.webhookToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "gateway.auth.password",
"configFile": "openclaw.json",
"path": "gateway.auth.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "gateway.auth.token",
"configFile": "openclaw.json",
"path": "gateway.auth.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "gateway.remote.password",
"configFile": "openclaw.json",
"path": "gateway.remote.password",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "gateway.remote.token",
"configFile": "openclaw.json",
"path": "gateway.remote.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "messages.tts.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "messages.tts.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "models.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.headers.*",
"configFile": "openclaw.json",
"path": "models.providers.*.headers.*",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.auth.token",
"configFile": "openclaw.json",
"path": "models.providers.*.request.auth.token",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.auth.value",
"configFile": "openclaw.json",
"path": "models.providers.*.request.auth.value",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.headers.*",
"configFile": "openclaw.json",
"path": "models.providers.*.request.headers.*",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.proxy.tls.ca",
"configFile": "openclaw.json",
"path": "models.providers.*.request.proxy.tls.ca",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.proxy.tls.cert",
"configFile": "openclaw.json",
"path": "models.providers.*.request.proxy.tls.cert",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.proxy.tls.key",
"configFile": "openclaw.json",
"path": "models.providers.*.request.proxy.tls.key",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.proxy.tls.passphrase",
"configFile": "openclaw.json",
"path": "models.providers.*.request.proxy.tls.passphrase",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.tls.ca",
"configFile": "openclaw.json",
"path": "models.providers.*.request.tls.ca",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.tls.cert",
"configFile": "openclaw.json",
"path": "models.providers.*.request.tls.cert",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.tls.key",
"configFile": "openclaw.json",
"path": "models.providers.*.request.tls.key",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "models.providers.*.request.tls.passphrase",
"configFile": "openclaw.json",
"path": "models.providers.*.request.tls.passphrase",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.acpx.config.mcpServers.*.env.*",
"configFile": "openclaw.json",
"path": "plugins.entries.acpx.config.mcpServers.*.env.*",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.brave.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.brave.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.codex.config.appServer.authToken",
"configFile": "openclaw.json",
"path": "plugins.entries.codex.config.appServer.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.codex.config.appServer.headers.*",
"configFile": "openclaw.json",
"path": "plugins.entries.codex.config.appServer.headers.*",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.exa.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.exa.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.firecrawl.config.webFetch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.firecrawl.config.webFetch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.firecrawl.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.firecrawl.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.google-meet.config.realtime.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.google-meet.config.realtime.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.google.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.google.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.minimax.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.minimax.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.moonshot.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.moonshot.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.parallel.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.parallel.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.perplexity.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.perplexity.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.tavily.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.tavily.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.voice-call.config.realtime.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.voice-call.config.realtime.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.voice-call.config.streaming.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.voice-call.config.streaming.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.voice-call.config.tts.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.voice-call.config.tts.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.voice-call.config.twilio.authToken",
"configFile": "openclaw.json",
"path": "plugins.entries.voice-call.config.twilio.authToken",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.webhooks.config.routes.*.secret",
"configFile": "openclaw.json",
"path": "plugins.entries.webhooks.config.routes.*.secret",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "plugins.entries.xai.config.webSearch.apiKey",
"configFile": "openclaw.json",
"path": "plugins.entries.xai.config.webSearch.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "skills.entries.*.apiKey",
"configFile": "openclaw.json",
"path": "skills.entries.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "talk.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "talk.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
},
{
"id": "talk.realtime.providers.*.apiKey",
"configFile": "openclaw.json",
"path": "talk.realtime.providers.*.apiKey",
"secretShape": "secret_input",
"optIn": true
}
]
}