Superficie de credenciales SecretRef

Esta página define la superficie de credenciales SecretRef canónica.

Intención de alcance:

En alcance: credenciales estrictamente proporcionadas por el usuario que OpenClaw no genera ni rota.
Fuera de alcance: credenciales generadas en runtime o rotadas, material de refresh OAuth, y artefactos tipo sesión.

Credenciales soportadas

Objetivos `openclaw.json` (`secrets configure` + `secrets apply` + `secrets audit`)

models.providers.*.apiKey
models.providers.*.headers.*
skills.entries.*.apiKey
agents.defaults.memorySearch.remote.apiKey
agents.list[].memorySearch.remote.apiKey
talk.apiKey
talk.providers.*.apiKey
messages.tts.elevenlabs.apiKey
messages.tts.openai.apiKey
tools.web.fetch.firecrawl.apiKey
tools.web.search.apiKey
tools.web.search.gemini.apiKey
tools.web.search.grok.apiKey
tools.web.search.kimi.apiKey
tools.web.search.perplexity.apiKey
gateway.auth.password
gateway.auth.token
gateway.remote.token
gateway.remote.password
cron.webhookToken
channels.telegram.botToken
channels.telegram.webhookSecret
channels.telegram.accounts.*.botToken
channels.telegram.accounts.*.webhookSecret
channels.slack.botToken
channels.slack.appToken
channels.slack.userToken
channels.slack.signingSecret
channels.slack.accounts.*.botToken
channels.slack.accounts.*.appToken
channels.slack.accounts.*.userToken
channels.slack.accounts.*.signingSecret
channels.discord.token
channels.discord.pluralkit.token
channels.discord.voice.tts.elevenlabs.apiKey
channels.discord.voice.tts.openai.apiKey
channels.discord.accounts.*.token
channels.discord.accounts.*.pluralkit.token
channels.discord.accounts.*.voice.tts.elevenlabs.apiKey
channels.discord.accounts.*.voice.tts.openai.apiKey
channels.irc.password
channels.irc.nickserv.password
channels.irc.accounts.*.password
channels.irc.accounts.*.nickserv.password
channels.bluebubbles.password
channels.bluebubbles.accounts.*.password
channels.feishu.appSecret
channels.feishu.encryptKey
channels.feishu.verificationToken
channels.feishu.accounts.*.appSecret
channels.feishu.accounts.*.encryptKey
channels.feishu.accounts.*.verificationToken
channels.msteams.appPassword
channels.mattermost.botToken
channels.mattermost.accounts.*.botToken
channels.matrix.password
channels.matrix.accounts.*.password
channels.nextcloud-talk.botSecret
channels.nextcloud-talk.apiPassword
channels.nextcloud-talk.accounts.*.botSecret
channels.nextcloud-talk.accounts.*.apiPassword
channels.zalo.botToken
channels.zalo.webhookSecret
channels.zalo.accounts.*.botToken
channels.zalo.accounts.*.webhookSecret
channels.googlechat.serviceAccount vía sibling serviceAccountRef (excepción de compatibilidad)
channels.googlechat.accounts.*.serviceAccount vía sibling serviceAccountRef (excepción de compatibilidad)

Objetivos `auth-profiles.json` (`secrets configure` + `secrets apply` + `secrets audit`)

profiles.*.keyRef (type: "api_key")
profiles.*.tokenRef (type: "token")

Credenciales no soportadas

Credenciales fuera de alcance incluyen:

commands.ownerDisplaySecret
channels.matrix.accessToken
channels.matrix.accounts.*.accessToken
hooks.token
hooks.gmail.pushToken
hooks.mappings[].sessionKey
auth-profiles.oauth.*
discord.threadBindings.*.webhookToken
whatsapp.creds.json

Justificación:

Estas credenciales son generadas, rotadas, con carga de sesión, o clases durables OAuth que no encajan en la resolución SecretRef externa de solo lectura.