fix(models): set authHeader for third-party anthropic-messages (MiniMax 401)

Match OpenClaw minimax onboard: authHeader true for non-api.anthropic.com hosts.

Migrate existing openclaw.json on load; extend seeds (synthetic, opencode, kimi-coding, cloudflare).

Release v0.3.4

Made-with: Cursor

Author: agentkernel

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to OpenClaw Desktop will be documented in this file.
 
+## [0.3.4] - 2026-03-26
+
+### Fixed
+
+- **MiniMax / third-party Anthropic HTTP 401:** Aligned with OpenClaw `extensions/minimax/onboard.ts` by setting **`authHeader: true`** on `anthropic-messages` providers that target non-`api.anthropic.com` hosts (MiniMax, Synthetic, OpenCode Zen, Kimi Coding, Cloudflare AI Gateway). Existing `openclaw.json` entries are migrated on load. Custom Anthropic-compatible bases get the same flag when the URL is not Anthropic’s official API.
+
 ## [0.3.3] - 2026-03-26
 
 ### Fixed

README.md

@@ -48,15 +48,17 @@ If you've been searching for *how to install OpenClaw on Windows*, *how to run O
 ## Quick Start
 
 1. Download the latest installer from [Releases](https://github.com/agentkernel/openclaw-desktop/releases/latest)
-2. Run `OpenClaw-Setup-0.3.3.exe`
+2. Run `OpenClaw-Setup-0.3.4.exe`
 3. Finish the setup wizard (provider → channel → gateway)
 4. Launch from Start Menu or Desktop shortcut
 
 **System:** Windows 10/11 x64 · ~350 MB free space · Internet for API calls
 
-## What's New in v0.3.3
+## What's New in v0.3.4
 
-- **MiniMax (401):** Auth profile id for API keys is **`minimax:global`** (same as the wizard and upstream). The LLM API path no longer maps `default` to `minimax:default`; it is normalized to **`minimax:global`**, and existing `minimax:default` entries in `auth-profiles.json` migrate on startup.
+- **MiniMax / Anthropic-compatible 401:** `models.providers.*` now sets **`authHeader: true`** for third-party `anthropic-messages` hosts (same as OpenClaw `extensions/minimax/onboard.ts`). Existing configs are migrated on startup—fixes invalid API key errors when the key is correct but auth headers did not match the host.
+
+Earlier highlights (v0.3.3): `minimax:global` profile id + auth-profiles migration.
 
 Earlier highlights (v0.3.2): Full profile ids for save/migrate/delete; `auth.order` normalization; delete passes `provider`.
 
@@ -124,8 +126,8 @@ OpenClaw Desktop is a **community-maintained Windows distribution** for the Open
 
 | | |
 |---|---|
-| **Release** | `v0.3.3` |
-| **Installer** | `OpenClaw-Setup-0.3.3.exe` |
+| **Release** | `v0.3.4` |
+| **Installer** | `OpenClaw-Setup-0.3.4.exe` |
 | **Platform** | Windows 10/11 x64 |
 | **Includes** | Electron shell, portable Node.js, bundled OpenClaw |
 | **Extras** | SHA-256 checksum, `latest.yml` for in-app updates |
@@ -206,7 +208,7 @@ pnpm run prepare-bundle
 pnpm run package:win   # Output: dist/OpenClaw-Setup-<version>.exe
 ```
 
-**Bundled OpenClaw:** Pinned in `package.json` (`openclawBundleVersion`). After `prepare-bundle`, see `bundledOpenClawVersion` in [`resources/bundle-manifest.json`](resources/bundle-manifest.json) (currently **2026.3.23-2** for desktop **v0.3.3**). Local checks: `pnpm run check-openclaw-versions` (omit `OPENCLAW_SKIP_NPM_LATEST_CHECK` to also compare against npm `latest`).
+**Bundled OpenClaw:** Pinned in `package.json` (`openclawBundleVersion`). After `prepare-bundle`, see `bundledOpenClawVersion` in [`resources/bundle-manifest.json`](resources/bundle-manifest.json) (currently **2026.3.23-2** for desktop **v0.3.4**). Local checks: `pnpm run check-openclaw-versions` (omit `OPENCLAW_SKIP_NPM_LATEST_CHECK` to also compare against npm `latest`).
 
 **Related docs:** [CHANGELOG.md](CHANGELOG.md) · [CONTRIBUTING.md](CONTRIBUTING.md)
 

README.zh-CN.md

@@ -48,15 +48,17 @@
 ## 快速开始
 
 1. 从 [Releases](https://github.com/agentkernel/openclaw-desktop/releases/latest) 下载最新安装包
-2. 运行 `OpenClaw-Setup-0.3.3.exe`
+2. 运行 `OpenClaw-Setup-0.3.4.exe`
 3. 完成设置向导（模型提供商 → 频道 → 网关）
 4. 从开始菜单或桌面快捷方式启动
 
 **系统要求：** Windows 10/11 x64 · 约 350 MB 可用空间 · 网络连接（用于 API 调用）
 
-## v0.3.3 更新亮点
+## v0.3.4 更新亮点
 
-- **MiniMax（401）：** API Key 凭据与向导一致，使用 **`minimax:global`**；不再将 `default` 误规范为 `minimax:default`。启动时会将旧的 `minimax:default` 条目迁移到 `minimax:global`。
+- **MiniMax / Anthropic 兼容 401：** 与 OpenClaw 上游一致，为第三方 **`anthropic-messages`** 端点设置 **`authHeader: true`**；启动时自动迁移已有 `openclaw.json`。密钥正确但仍报 invalid api key 时多属此类问题。
+
+更早版本（v0.3.3）要点：`minimax:global` 与 auth-profiles 迁移 — 详见 [CHANGELOG.md](CHANGELOG.md)。
 
 更早版本（v0.3.2）要点：完整 profile id 的保存/迁移/删除与 `auth.order` 规范化 — 详见 [CHANGELOG.md](CHANGELOG.md)。
 
@@ -124,8 +126,8 @@ OpenClaw Desktop 是 OpenClaw 生态的**社区维护 Windows 分发版**，属
 
 | | |
 |---|---|
-| **当前版本** | `v0.3.3` |
-| **安装包** | `OpenClaw-Setup-0.3.3.exe` |
+| **当前版本** | `v0.3.4` |
+| **安装包** | `OpenClaw-Setup-0.3.4.exe` |
 | **适用系统** | Windows 10/11 x64 |
 | **包含内容** | Electron 外壳、便携 Node.js、捆绑 OpenClaw |
 | **附加产物** | SHA-256 校验文件、`latest.yml`（应用内更新用） |
@@ -154,7 +156,7 @@ OpenClaw Desktop 是 OpenClaw 生态的**社区维护 Windows 分发版**，属
 <details>
 <summary><strong>如何在 Windows 上安装 OpenClaw？</strong></summary>
 
-从[最新发布页](https://github.com/agentkernel/openclaw-desktop/releases/latest)下载 `OpenClaw-Setup-0.3.3.exe` 并运行即可。无需 `npm`、无需系统级 Node.js、无需输入任何终端命令。
+从[最新发布页](https://github.com/agentkernel/openclaw-desktop/releases/latest)下载 `OpenClaw-Setup-0.3.4.exe` 并运行即可。无需 `npm`、无需系统级 Node.js、无需输入任何终端命令。
 </details>
 
 <details>
@@ -206,7 +208,7 @@ pnpm run prepare-bundle
 pnpm run package:win   # 输出: dist/OpenClaw-Setup-<version>.exe
 ```
 
-**捆绑 OpenClaw：** 在 `package.json` 中通过 `openclawBundleVersion` 固定；执行 `prepare-bundle` 后查看 [`resources/bundle-manifest.json`](resources/bundle-manifest.json) 中的 `bundledOpenClawVersion`（桌面 **v0.3.3** 当前为 **2026.3.23-2**）。本地校验：`pnpm run check-openclaw-versions`（不设 `OPENCLAW_SKIP_NPM_LATEST_CHECK` 时还会与 npm `latest` 对比）。
+**捆绑 OpenClaw：** 在 `package.json` 中通过 `openclawBundleVersion` 固定；执行 `prepare-bundle` 后查看 [`resources/bundle-manifest.json`](resources/bundle-manifest.json) 中的 `bundledOpenClawVersion`（桌面 **v0.3.4** 当前为 **2026.3.23-2**）。本地校验：`pnpm run check-openclaw-versions`（不设 `OPENCLAW_SKIP_NPM_LATEST_CHECK` 时还会与 npm `latest` 对比）。
 
 **相关文档：** [CHANGELOG.md](CHANGELOG.md) · [CONTRIBUTING.md](CONTRIBUTING.md)
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-desktop",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "openclawBundleVersion": "2026.3.23-2",
   "description": "Community-maintained Windows desktop app and installer for OpenClaw.",
   "type": "module",

resources/bundle-manifest.json

@@ -1,4 +1,4 @@
 {
-  "shellVersion": "0.3.3",
+  "shellVersion": "0.3.4",
   "bundledOpenClawVersion": "2026.3.23-2"
 }

src/main/config/openclaw-config.ts

@@ -171,6 +171,42 @@ function migrateAuthOrderFullProfileIds(
   return { config: next, changed: true }
 }
 
+/**
+ * OpenClaw `extensions/minimax/onboard.ts` sets `authHeader: true` for third-party Anthropic-compatible
+ * APIs (MiniMax, Synthetic, etc.). Without it, gateways can get HTTP 401 from hosts that expect
+ * Bearer-style auth (see upstream issue #29169). Only set when missing; do not override explicit values.
+ */
+function migrateAnthropicThirdPartyAuthHeader(
+  config: OpenClawConfig,
+): { config: OpenClawConfig; changed: boolean } {
+  const providers = config.models?.providers
+  if (!providers || typeof providers !== 'object') {
+    return { config, changed: false }
+  }
+  let changed = false
+  const next = JSON.parse(JSON.stringify(config)) as OpenClawConfig
+  const nextProviders = next.models?.providers
+  if (!nextProviders || typeof nextProviders !== 'object') {
+    return { config, changed: false }
+  }
+
+  for (const [, raw] of Object.entries(nextProviders)) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) continue
+    const p = raw as Record<string, unknown>
+    if (p.authHeader !== undefined) continue
+    const api = typeof p.api === 'string' ? p.api : ''
+    if (api !== 'anthropic-messages') continue
+    const baseUrl = typeof p.baseUrl === 'string' ? p.baseUrl : ''
+    if (!baseUrl.trim()) continue
+    if (baseUrl.includes('api.anthropic.com')) continue
+    p.authHeader = true
+    changed = true
+  }
+
+  if (!changed) return { config, changed: false }
+  return { config: next, changed: true }
+}
+
 /**
  * OpenClaw 2026.1.29+: gateway auth mode `none` removed — gateway must use token or password.
  * Migrate legacy `mode: "none"` using whichever credential field is present.
@@ -331,13 +367,16 @@ export function readOpenClawConfig(): OpenClawConfig {
       cfg = migratedAuthNone.config
       const migratedAuthOrder = migrateAuthOrderFullProfileIds(cfg)
       cfg = migratedAuthOrder.config
+      const migratedAuthHeader = migrateAnthropicThirdPartyAuthHeader(cfg)
+      cfg = migratedAuthHeader.config
       if (
         migratedProviders.changed ||
         migratedFeishu.changed ||
         migratedControlUiRoot.changed ||
         migratedControlUi.changed ||
         migratedAuthNone.changed ||
-        migratedAuthOrder.changed
+        migratedAuthOrder.changed ||
+        migratedAuthHeader.changed
       ) {
         try {
           writeOpenClawConfig(cfg)
@@ -363,6 +402,11 @@ export function readOpenClawConfig(): OpenClawConfig {
           if (migratedAuthOrder.changed) {
             console.info('[config] Normalized auth.order profile ids to full form (provider:name) in openclaw.json')
           }
+          if (migratedAuthHeader.changed) {
+            console.info(
+              '[config] Set models.providers.*.authHeader=true for third-party anthropic-messages hosts in openclaw.json',
+            )
+          }
         } catch (err) {
           console.warn(
             '[config] Failed to persist migrated openclaw config:',

src/main/wizard/setup-handler.ts

@@ -47,6 +47,11 @@ type ProviderSeed = {
   baseUrl: string
   /** OpenClaw `models.providers.*.api`; omit for plugin-native providers (e.g. Google Gemini). */
   api?: string
+  /**
+   * Third-party Anthropic-compatible hosts need `authHeader: true` so the gateway sends the same
+   * auth as upstream `applyMinimaxApiConfig` / OpenClaw issue #29169 (MiniMax 401 without Bearer).
+   */
+  authHeader?: boolean
 }
 
 const PROVIDER_SEEDS: Partial<Record<ModelProvider, ProviderSeed>> = {
@@ -79,6 +84,7 @@ const PROVIDER_SEEDS: Partial<Record<ModelProvider, ProviderSeed>> = {
     providerId: 'opencode',
     baseUrl: 'https://opencode.ai/zen/v1',
     api: 'anthropic-messages',
+    authHeader: true,
   },
   'vercel-ai-gateway': {
     providerId: 'vercel-ai-gateway',
@@ -94,11 +100,13 @@ const PROVIDER_SEEDS: Partial<Record<ModelProvider, ProviderSeed>> = {
     providerId: 'kimi-coding',
     baseUrl: 'https://api.kimi.com/coding/',
     api: 'anthropic-messages',
+    authHeader: true,
   },
   minimax: {
     providerId: 'minimax',
     baseUrl: 'https://api.minimax.io/anthropic',
     api: 'anthropic-messages',
+    authHeader: true,
   },
   xai: {
     providerId: 'xai',
@@ -124,6 +132,7 @@ const PROVIDER_SEEDS: Partial<Record<ModelProvider, ProviderSeed>> = {
     providerId: 'synthetic',
     baseUrl: 'https://api.synthetic.new/anthropic',
     api: 'anthropic-messages',
+    authHeader: true,
   },
   venice: {
     providerId: 'venice',
@@ -310,6 +319,7 @@ function ensureProviderSeedConfig(config: OpenClawConfig, state: WizardState): v
       ...(config.models.providers['cloudflare-ai-gateway'] ?? {}),
       baseUrl: `https://gateway.ai.cloudflare.com/v1/${accountId}/${gatewayId}/anthropic`,
       api: 'anthropic-messages',
+      authHeader: true,
       ...(state.modelConfig.apiKey.trim() ? { apiKey: state.modelConfig.apiKey.trim() } : {}),
       models: [buildDefaultProviderModel(modelId)],
     }
@@ -400,6 +410,7 @@ function ensureProviderSeedConfig(config: OpenClawConfig, state: WizardState): v
     baseUrl: seed.baseUrl,
     ...(seed.api ? { api: seed.api } : {}),
     ...(apiKey ? { apiKey } : {}),
+    ...(seed.authHeader !== undefined ? { authHeader: seed.authHeader } : {}),
     models: [buildDefaultProviderModel(modelId)],
   }
 }
@@ -478,13 +489,16 @@ function buildOpenClawConfig(state: WizardState): OpenClawConfig {
     const compatibility = state.modelConfig.customCompatibility ?? 'openai'
     const api = compatibility === 'anthropic' ? 'anthropic-messages' : 'openai-completions'
     if (baseUrl) {
+      const thirdPartyAnthropic =
+        compatibility === 'anthropic' && !baseUrl.includes('api.anthropic.com')
       config.models = {
         mode: 'merge',
         providers: {
           [providerId]: {
             baseUrl,
             api,
             apiKey: state.modelConfig.apiKey.trim(),
+            ...(thirdPartyAnthropic ? { authHeader: true } : {}),
             models: [buildDefaultProviderModel(modelId || 'default')],
           },
         },

src/shared/types.ts

@@ -212,7 +212,10 @@ export interface ModelProviderConfig {
   apiKey?: string
   /** Custom HTTP headers */
   headers?: Record<string, string>
-  /** Whether to send Authorization (false for local proxies like copilot-proxy) */
+  /**
+   * Third-party `anthropic-messages` hosts (MiniMax, Synthetic, Cloudflare gateway, etc.) need `true`
+   * so the gateway matches OpenClaw upstream onboard configs. Use `false` for local proxies (e.g. copilot-proxy).
+   */
   authHeader?: boolean
   models?: Array<Record<string, unknown> & { id: string; name?: string }>
 }