larksuite/cli · error

secret provider %q is not configured (ref: %s:%s:%s)

Error message

secret provider %q is not configured (ref: %s:%s:%s)

What it means

LookupProvider returns this when the named provider (explicit or the default alias) is absent from secrets.providers and the ref is not the special-case implicit default env ref. The message echoes the full ref (source:provider:id) to make the missing binding diagnosable.

Source

Thrown at internal/binding/types.go:225

	if cfg != nil && cfg.Providers != nil {
		if pc, ok := cfg.Providers[providerName]; ok {
			if pc == nil {
				return nil, fmt.Errorf("secret provider %q is configured as null", providerName)
			}
			if pc.Source != ref.Source {
				return nil, fmt.Errorf("secret provider %q has source %q but ref requests %q",
					providerName, pc.Source, ref.Source)
			}
			return pc, nil
		}
	}

	// Special case: default env provider (implicit, per OpenClaw resolve.ts)
	if ref.Source == "env" && providerName == DefaultProviderAlias {
		return &ProviderConfig{Source: "env"}, nil
	}

	return nil, fmt.Errorf("secret provider %q is not configured (ref: %s:%s:%s)",
		providerName, ref.Source, providerName, ref.ID)
}

// CandidateApp represents a bindable app from OpenClaw's feishu channel config.
type CandidateApp struct {
	Label     string
	AppID     string
	AppSecret SecretInput
	Brand     string
}

// ListCandidateApps enumerates all bindable (enabled) apps from a FeishuChannel.
// Disabled accounts (enabled: false) are filtered out.
func ListCandidateApps(ch *FeishuChannel) []CandidateApp {
	if ch == nil {
		return nil
	}
	if len(ch.Accounts) > 0 {

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Add the named provider to secrets.providers with the matching source
2. Remove or correct the ref's `provider` field (env refs fall back to the implicit default env provider)
3. Verify the intended config file is actually being loaded

Example fix

// before
{"source": "exec", "id": "tok", "provider": "myvault"} // myvault missing
// after
{"secrets": {"providers": {"myvault": {"source": "exec"}}}} or {"source": "exec", "id": "tok"} with a configured default

for _, ref := range refs {
    if ref.Provider != "" && ref.Provider != "default" {
        if _, ok := cfg.Secrets.Providers[ref.Provider]; !ok {
            return fmt.Errorf("provider %q referenced but not configured", ref.Provider)
        }
    }
}

When it happens

Trigger: A ref with provider "myvault" when providers has no "myvault" key; a non-env ref relying on the default alias with no default provider configured.

Common situations: Renamed provider sections in config; config file not loaded (wrong profile/path); refs copied between projects with different provider sets.

Related errors

• secret provider %q is configured as null
• secret provider %q has source %q but ref requests %q
• appSecret is missing or empty
• appSecret is empty string
• env variable %q referenced in openclaw.json is not set or em

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/8532038c253432a5. Report an issue: GitHub.