OpenClaw merged a P0 onboarding fix Tuesday morning that restores grouped AI authentication choices in the guided setup flow. It also fixes a ChatGPT login path where the setup probe could fail because OpenAI received an oversized prompt_cache_key.
The bug affected fresh guided onboarding when OpenClaw could not import an existing AI credential. Instead of showing the compact provider-and-method picker, the flow could fall back to a long, flat API-key-oriented list.
Source: OpenClaw PR #107038
What Was Broken
Fresh users need onboarding to make the first credential decision feel predictable. PR #107038 describes three problems in that flow:
- OAuth and device-code sign-in methods were omitted.
- Related provider methods were not grouped together.
- Secondary providers crowded the first screen.
The same setup path could also generate a 66-character setup probe session identifier. OpenAI forwarded that value as prompt_cache_key, where the limit is 64 characters, causing the probe to be rejected after the user completed ChatGPT login.
That combination is especially rough for a first-run experience: the UI offers worse choices, then one of the friendlier login paths can fail after the callback is pasted.
What Changed
Guided onboarding now reuses OpenClaw's canonical grouped provider and auth picker. The first screen keeps the established order for OpenAI, Anthropic, xAI, Google, and OpenRouter, while other installed provider choices remain searchable under More….
Each provider owns a second-level auth-method menu, so browser OAuth, device-code login, and API-key paths can appear where users expect them. Detection and activation still exchange the manifest's exact auth choice ID rather than inventing a parallel setup contract.
For the probe failure, OpenClaw now uses the existing 58-character run ID directly as the session identifier. The PR notes that earlier cache-key defenses did not prevent the provider rejection; bounding the session identifier did.
User Impact
Fresh guided onboarding should again feel like a provider picker rather than a raw credential dump. Users can choose ChatGPT login, paste the callback URL, and complete the setup probe without hitting the oversized cache-key failure.
The flow also keeps secondary choices available without letting them dominate the first screen. MiniMax regions, Xiaomi, OpenCode, and other installed provider options remain under More… instead of appearing as unrelated top-level entries.
Choosing Skip for now exits onboarding without starting AI chat, preserving the intended opt-out path.
Verification
The PR includes real behavior proof from a fresh Dockerized OpenClaw setup. Before the fix, the 66-character prompt_cache_key rejection was reproduced. After the bounded session-ID change, the ChatGPT OAuth callback was accepted and the setup probe returned a usable reply.
Focused validation also passed:
- 31 grouped-picker and guided-onboarding tests.
- A setup-inference regression that asserts the 58-character probe session ID.
- Type-aware oxlint for changed TypeScript files.
- Docs MDX validation for the updated onboarding pages.
- Fresh autoreview with no accepted or actionable findings.