Adapted community discussion: Paraphrased and condensed from an anonymized public OpenClaw Discord support conversation from August 2026. Technical guidance was reviewed for OpenClaw 2026.9.3.
I am on macOS with a Claude subscription. The Claude CLI login works in my terminal, but both OpenClaw agents fail almost immediately through the managed Gateway with session_expired.
I refreshed the Claude login, repaired stale OpenClaw auth profiles, set the intended auth order, and restarted the Gateway. The service and channels look healthy. Where else can the Claude CLI backend be getting an expired credential?
On recent Claude Code versions, the active OAuth credential can live in the macOS login Keychain. A credential file in the home directory may be a legacy artifact. The managed Gateway also runs in a different environment from your interactive terminal.
Test Claude itself under the same macOS user and credential context as the Gateway:
claude auth status --text
printf 'ping\n' | claude -p --output-format stream-json --verbose --setting-sources user
If the second command fails, repair the Claude Code login or Keychain state. If it works in Terminal but fails only under the managed service, compare the service user, home directory, path, and whether the login Keychain is unlocked.
An OpenClaw Anthropic auth profile is a different route. Changing that profile does not repair Claude CLI’s native Keychain login.
That diagnosis helped, and I marked it as the solution. Running the Gateway interactively works as a temporary workaround. Before I put it back under the macOS service, does the newer OpenClaw fix make Keychain access work, or does it only stop retrying an expired Claude profile?
The newer OpenClaw behavior prevents an expired CLI profile from retrying forever and reports the failed route more clearly. It does not grant a background macOS service access to a locked or different user’s Keychain.
For an always-on service, you have two clean choices: make the managed Gateway run as the same user with access to the valid Claude login, or use a separate Anthropic credential route that the service owns. Current OpenClaw can create or synchronize a provider setup token with:
openclaw models auth setup-token --provider anthropic
openclaw models status --probe --probe-provider anthropic
Keep the Claude CLI and direct Anthropic routes conceptually separate. They have different credential ownership and can have different billing or quota behavior.