Require API key in Unraid gateway templates

docs/telegram-gateway-operator-guide.md

@@ -110,14 +110,13 @@ The gateway container needs:
 - Docker network
   - `claw_gateway`
 
-Recommended auth:
-
-- `ANTHROPIC_AUTH_TOKEN`
-
-Optional legacy auth:
-
 - `ANTHROPIC_API_KEY`
 
+Bearer-only auth is not currently supported by the Anthropic Messages API used by this runtime.
+If you pass only `ANTHROPIC_AUTH_TOKEN`, workers will fail with:
+
+- `401 Unauthorized (authentication_error): OAuth authentication is currently not supported.`
+
 The gateway copies inherited auth env vars into worker containers according to `CLAW_GATEWAY_INHERITED_ENV`.
 
 ## First Boot
@@ -157,7 +156,7 @@ Example:
     "template_dir": "/unraid/templates-user",
     "template_file_prefix": "claw-worker-",
     "template_archive_dir": "/appdata/template-archive",
-    "inherited_env": ["ANTHROPIC_AUTH_TOKEN"]
+    "inherited_env": ["ANTHROPIC_API_KEY"]
   },
   "worker_defaults": {
     "bind_port": 8080,

my-claw-telegram.xml

@@ -20,7 +20,7 @@
   <DateInstalled/>
   <DonateText/>
   <DonateLink/>
-  <Requires>Docker socket access and Anthropic OAuth token or API key</Requires>
+  <Requires>Docker socket access and an Anthropic API key</Requires>
   <Config Name="Docker Socket" Target="/var/run/docker.sock" Default="/var/run/docker.sock" Mode="rw" Description="Docker socket for worker orchestration; this grants root-equivalent control of the host" Type="Path" Display="always" Required="true" Mask="false">/var/run/docker.sock</Config>
   <Config Name="Unraid Templates" Target="/unraid/templates-user" Default="/boot/config/plugins/dockerMan/templates-user" Mode="rw" Description="Unraid template directory where the gateway writes managed worker templates" Type="Path" Display="always" Required="true" Mask="false">/boot/config/plugins/dockerMan/templates-user</Config>
   <Config Name="Gateway AppData" Target="/appdata" Default="/mnt/user/appdata/claw-telegram-gateway" Mode="rw" Description="Gateway state and manifest directory" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/claw-telegram-gateway</Config>
@@ -33,9 +33,9 @@
   <Config Name="Template Dir" Target="CLAW_GATEWAY_TEMPLATE_DIR" Default="/unraid/templates-user" Mode="" Description="Unraid template directory path inside the gateway container" Type="Variable" Display="advanced" Required="true" Mask="false">/unraid/templates-user</Config>
   <Config Name="Template Archive Dir" Target="CLAW_GATEWAY_TEMPLATE_ARCHIVE_DIR" Default="/appdata/template-archive" Mode="" Description="Archive location for removed worker templates" Type="Variable" Display="advanced" Required="true" Mask="false">/appdata/template-archive</Config>
   <Config Name="Worker Network" Target="CLAW_GATEWAY_WORKER_NETWORK" Default="claw_gateway" Mode="" Description="Docker network name shared by the gateway and workers" Type="Variable" Display="advanced" Required="true" Mask="false">claw_gateway</Config>
-  <Config Name="Inherited Env" Target="CLAW_GATEWAY_INHERITED_ENV" Default="ANTHROPIC_AUTH_TOKEN" Mode="" Description="Comma-separated env vars copied from gateway into worker containers" Type="Variable" Display="advanced" Required="false" Mask="false">ANTHROPIC_AUTH_TOKEN</Config>
+  <Config Name="Inherited Env" Target="CLAW_GATEWAY_INHERITED_ENV" Default="ANTHROPIC_API_KEY" Mode="" Description="Comma-separated env vars copied from gateway into worker containers" Type="Variable" Display="advanced" Required="false" Mask="false">ANTHROPIC_API_KEY</Config>
   <Config Name="Worker Ready Timeout (s)" Target="CLAW_GATEWAY_WORKER_READY_TIMEOUT_SECS" Default="15" Mode="" Description="Seconds to wait for a worker container to pass its health check" Type="Variable" Display="advanced" Required="false" Mask="false">15</Config>
-  <Config Name="Anthropic OAuth Token" Target="ANTHROPIC_AUTH_TOKEN" Default="" Mode="" Description="Anthropic OAuth bearer token inherited by worker containers" Type="Variable" Display="always" Required="false" Mask="true"></Config>
-  <Config Name="Anthropic API Key" Target="ANTHROPIC_API_KEY" Default="" Mode="" Description="Optional legacy Anthropic API key inherited by worker containers" Type="Variable" Display="advanced" Required="false" Mask="true"></Config>
+  <Config Name="Anthropic API Key" Target="ANTHROPIC_API_KEY" Default="" Mode="" Description="Anthropic API key inherited by worker containers for Messages API access" Type="Variable" Display="always" Required="true" Mask="true"></Config>
+  <Config Name="Anthropic OAuth Token" Target="ANTHROPIC_AUTH_TOKEN" Default="" Mode="" Description="Not used by the current gateway deployment because the Anthropic API still requires x-api-key auth" Type="Variable" Display="advanced" Required="false" Mask="true"></Config>
   <TailscaleStateDir/>
 </Container>

rust/crates/claw-telegram/assets/unraid/claw-telegram-gateway.xml

@@ -33,9 +33,9 @@
   <Config Name="CLAW_GATEWAY_TEMPLATE_DIR" Target="CLAW_GATEWAY_TEMPLATE_DIR" Default="/unraid/templates-user" Mode="" Description="Unraid template directory path inside the gateway container" Type="Variable" Display="advanced" Required="true" Mask="false">/unraid/templates-user</Config>
   <Config Name="CLAW_GATEWAY_TEMPLATE_ARCHIVE_DIR" Target="CLAW_GATEWAY_TEMPLATE_ARCHIVE_DIR" Default="/appdata/template-archive" Mode="" Description="Archive location for removed worker templates" Type="Variable" Display="advanced" Required="true" Mask="false">/appdata/template-archive</Config>
   <Config Name="CLAW_GATEWAY_WORKER_NETWORK" Target="CLAW_GATEWAY_WORKER_NETWORK" Default="claw_gateway" Mode="" Description="Docker network name shared by the gateway and workers" Type="Variable" Display="advanced" Required="true" Mask="false">claw_gateway</Config>
-  <Config Name="CLAW_GATEWAY_INHERITED_ENV" Target="CLAW_GATEWAY_INHERITED_ENV" Default="ANTHROPIC_AUTH_TOKEN" Mode="" Description="Comma-separated env vars copied from gateway into worker containers" Type="Variable" Display="advanced" Required="false" Mask="false">ANTHROPIC_AUTH_TOKEN</Config>
+  <Config Name="CLAW_GATEWAY_INHERITED_ENV" Target="CLAW_GATEWAY_INHERITED_ENV" Default="ANTHROPIC_API_KEY" Mode="" Description="Comma-separated env vars copied from gateway into worker containers" Type="Variable" Display="advanced" Required="false" Mask="false">ANTHROPIC_API_KEY</Config>
   <Config Name="CLAW_GATEWAY_WORKER_READY_TIMEOUT_SECS" Target="CLAW_GATEWAY_WORKER_READY_TIMEOUT_SECS" Default="15" Mode="" Description="Seconds to wait for a worker container to pass its health check" Type="Variable" Display="advanced" Required="false" Mask="false">15</Config>
-  <Config Name="ANTHROPIC_AUTH_TOKEN" Target="ANTHROPIC_AUTH_TOKEN" Default="" Mode="" Description="Anthropic OAuth bearer token inherited by worker containers" Type="Variable" Display="advanced" Required="false" Mask="true"></Config>
-  <Config Name="ANTHROPIC_API_KEY" Target="ANTHROPIC_API_KEY" Default="" Mode="" Description="Optional legacy Anthropic API key if you do not use OAuth bearer auth" Type="Variable" Display="advanced" Required="false" Mask="true"></Config>
+  <Config Name="ANTHROPIC_API_KEY" Target="ANTHROPIC_API_KEY" Default="" Mode="" Description="Anthropic API key inherited by worker containers for Messages API access" Type="Variable" Display="always" Required="true" Mask="true"></Config>
+  <Config Name="ANTHROPIC_AUTH_TOKEN" Target="ANTHROPIC_AUTH_TOKEN" Default="" Mode="" Description="Not used by the current gateway deployment because the Anthropic API still requires x-api-key auth" Type="Variable" Display="advanced" Required="false" Mask="true"></Config>
   <TailscaleStateDir></TailscaleStateDir>
 </Container>