OpenClaw merged a focused OpenAI provider reliability fix in PR #102860: Realtime client-secret creation now has a 30-second guarded deadline.
The problem was a stalled setup path. OpenAI Realtime voice and transcription sessions need an ephemeral client secret before the browser-side session can proceed. If the client-secret endpoint accepted the POST but never returned a response, OpenClaw could sit behind the transport's much longer timeout.
For interactive voice workflows, that delay is visible. A user trying to start a Realtime voice or transcription session needs a quick setup success or a clear setup failure, not a multi-minute hang.
The Deadline Lives At The Shared Helper
The PR updates the shared createOpenAIRealtimeSecret path, which is used by both Realtime voice and transcription secret creation.
That placement keeps the behavior consistent across both public helper paths. One 30-second deadline now sits at the existing guarded-fetch boundary instead of being duplicated higher up in separate voice and transcription flows.
The patch preserves the rest of the provider boundary:
- The fixed OpenAI origin remains in place.
- SSRF allowlist behavior is unchanged.
- Request body and auth headers stay the same.
- Bounded response parsing is preserved.
- Existing 401 remediation behavior still applies.
In other words, this is a timeout hardening change, not a broad rewrite of how OpenAI Realtime sessions are authorized.
Failure Becomes Faster And Clearer
After the fix, a stalled OpenAI client-secret request reaches OpenClaw's existing Realtime setup failure path after 30 seconds. That is still long enough to tolerate ordinary network delay, but short enough to avoid leaving the user wondering whether the voice session is starting.
The distinction is especially important for browser Realtime flows because the client secret is only the setup step. Until it returns, the browser cannot move on to the actual Realtime transport.
The Proof Covers The Real Path
The PR includes focused Testbox coverage showing both OpenAI Realtime secret helpers supply the 30-second deadline, and that the guarded-fetch implementation terminates stalled requests.
It also includes a live production-path proof against the official OpenAI endpoint. The run invoked buildOpenAIRealtimeVoiceProvider().createBrowserSession(...) through the hydrated Testbox profile and completed in 575 ms with a WebRTC transport and a present client secret. The credential value was not printed.
That combination is useful: one test proves the timeout contract, while the live path confirms current OpenAI setup still succeeds inside the new budget.
Why It Matters
OpenClaw's voice stack depends on fast, understandable setup behavior. A stalled secret request should not feel like a broken microphone, a dead browser session, or a frozen agent.
This change tightens the provider edge where the stall actually happens. It gives OpenClaw a predictable setup failure path while keeping the existing OpenAI security and response-bounding rules intact.