AI Agent Not Responding? API Key & Auth Errors
Most people picture "not responding" as one failure — the agent is broken, full stop. In practice, an auth error can mean at least three different things depending on which layer failed: your local config never had the key in the first place, the key made it to the gateway but the gateway couldn't validate it, or the key reached the provider and got rejected there. Each of those has a different fix, and the generic-looking error message ("agent not responding," a silent timeout, a 401) often doesn't tell you which layer you're actually in until you run the right diagnostic command.
OpenClaw and Hermes handle this in a genuinely similar shape — a local config/env file holds the key, a diagnostic command tells you what's actually configured, and the failure can happen at the local, gateway, or provider level. We'll walk through both in full, since the specific commands differ even though the architecture doesn't.
Quick Diagnosis
| Symptom | Likely Layer |
|---|---|
| "No API key found for provider" / key missing entirely | Local config — the key was never saved |
| Model responds from one provider but not another you configured | Local config — key exists for a different provider than the one selected |
| 401 Unauthorized reaching the provider | Provider layer — key is invalid, expired, or revoked |
| "OAuth token refresh failed" | Gateway layer — session credentials failed to renew |
| Agent goes silent with no error at all | Often not auth at all — check logs before assuming it's a key problem |
1. OpenClaw
OpenClaw's authentication runs through three layers, and knowing which one produced your error message saves a lot of guessing: local config (~/.openclaw/openclaw.json and auth-profiles.json), the gateway (which validates credentials and manages provider connections), and the upstream provider itself (Anthropic, OpenAI, OpenRouter, and so on).
The error message usually tells you which layer failed, if you read it literally instead of assuming it's all "an API key problem":
- "No API key found for provider X" → local config layer. The key was never saved for that provider, or it's saved under the wrong provider name.
- "OAuth token refresh failed" → gateway layer. The session credential itself expired or failed to renew.
- A 401 from the provider → the key reached Anthropic/OpenAI/OpenRouter and was rejected there — expired, revoked, or wrong account.
Start with the diagnostic commands rather than editing config blind:
openclaw models status # shows each provider: valid, invalid, or in cooldown
openclaw doctor --fix # auto-repairs common config issues
openclaw logs --follow # watch the actual request/response as it happens
If models status shows a provider as "Missing auth" even though you're sure you configured it, check for a stale override before assuming the config file is wrong — environment variables and Docker .env files take precedence over the config file silently:
docker exec <container_name> env | grep OPENCLAW
A key that looks right at a glance isn't proof it's valid — Anthropic keys start with sk-ant-api03-, which is a useful sanity check, but the only durable proof is the provider actually accepting it for the model you selected. If a provider shows "cooldown" rather than "invalid" in models status, that's a rate limit or a transient failure, not a bad key — treat it as a pointer back to the original failed request, not proof your current key is wrong.
If you followed our OpenClaw installation guide and hit this error right after setup, it's almost always the local config layer — the onboarding wizard sometimes writes the key under a slightly different provider name than the one your agents.defaults.model.primary points to. Re-run openclaw models status and confirm the provider name matches exactly.
2. Hermes
Hermes splits config the same way conceptually — secrets live in ~/.hermes/.env, model and provider settings live in ~/.hermes/config.yaml — and the failure modes map to the same idea: is the key missing, is it for the wrong provider, or did it reach the provider and get rejected.
Check what's actually configured before assuming the key is the problem:
hermes config show # what model and provider Hermes thinks it's using
hermes model # re-run the interactive provider setup
hermes doctor # catches roughly 80% of common issues automatically
If the key is missing or wrong, set it directly:
hermes config set OPENROUTER_API_KEY sk-or-v1-xxxxxxxxxxxx
Two mismatches account for most Hermes auth failures, and both look identical from the error message alone:
- Wrong provider for the key. An OpenAI key won't authenticate against OpenRouter and vice versa — check
~/.hermes/.envdirectly for conflicting entries:
cat ~/.hermes/.env | grep API_KEY
- Key valid, model wrong or inaccessible. This surfaces as an HTTP 400 rather than a 401 — the key authenticated fine, but the specific model isn't available on that provider or account tier. Test with a known-good model to isolate it:
hermes chat -q "hello" --model anthropic/claude-opus-4.7
If you followed our Hermes installation guide and hit this error, it's most often the "key saved, but for the wrong provider" case — the setup wizard occasionally skips the key prompt entirely if an old key from a previous attempt is still present, so hermes config show is worth running before re-entering anything.
A Quick Note on n8n
n8n's auth model isn't a single API key sitting in an env file the way OpenClaw's and Hermes' are — credentials are stored encrypted per-node through the UI, protected by N8N_ENCRYPTION_KEY. If that key is lost or changes, every stored credential becomes unreadable at once rather than one provider failing at a time — a fundamentally different failure mode from "wrong key for this provider." If you're troubleshooting n8n credential errors specifically, that's a distinct enough problem that it deserves its own read rather than a few lines here.
Myth vs. Reality
Myth: "Agent not responding" always means the API key is wrong.
Reality: The exact same silence or generic error can come from three different layers — a key that was never saved, a gateway session that failed to refresh, or a key that reached the provider and got rejected — and each needs a different fix. Think of it less like "the key is bad" and more like a dead phone line: the problem could be your phone, the exchange, or the person on the other end, and you troubleshoot each one differently.
Troubleshooting
| Symptom | Fix |
|---|---|
| OpenClaw: "No API key found for provider X" | Local config issue — run openclaw models status, check for a stale Docker env override |
| OpenClaw: 401 from the provider itself | Key reached the provider and was rejected — regenerate it at the provider's console |
| Hermes: key missing or "provider not found" | hermes config show, then hermes config set <PROVIDER>_API_KEY ... |
| Hermes: HTTP 400 after setup completes fine | Not an auth problem — model ID mismatch; test with a known-good model |
| Auth looks fine but agent still won't respond | If the auth error persists, it may be a deeper environment issue — see our dependency guide |
Bottom Line
An unresponsive agent almost always traces back to one of three layers — local config, gateway session, or the upstream provider — and the exact error message tells you which one if you read it literally instead of assuming "bad key" by default. OpenClaw and Hermes both expose diagnostic commands (openclaw models status / hermes config show) specifically so you don't have to guess; use them before touching any config file by hand. n8n's credential model works differently enough that it's worth treating separately if that's what you're debugging.
Once errors are resolved, learn how to keep your agent running reliably on a VPS — the same diagnostic habit (check the specific error before assuming the obvious cause) applies just as much to a crash loop at 3 AM as it does to a key that won't authenticate.