1---2name: openclaw-schema-map3description: Complete map of the OpenClaw config schema from source code. THE single source of truth for valid config keys.4---56# Changelog7- 2026-03-19: Initial extraction from repos/openclaw/src/config/zod-schema.ts89# OpenClaw Config Schema Map (from source code)1011## SOURCE12Extracted from Zod schema: `repos/openclaw/src/config/zod-schema.ts`13THIS IS AUTHORITATIVE. If docs disagree with this, this is correct.1415## How to Regenerate16```bash17cd /data/.openclaw/workspace-clawexpert/repos/openclaw && git pull18cat src/config/zod-schema.ts19```2021---2223## Root-Level Keys (ALL valid keys — schema is `.strict()`)2425| Key | Type | Required | Notes |26|-----|------|----------|-------|27| `$schema` | string | No | Schema URL |28| `meta` | object | No | lastTouchedVersion, lastTouchedAt |29| `env` | object | No | shellEnv, vars, catchall string |30| `wizard` | object | No | lastRunAt, lastRunVersion, etc. |31| `diagnostics` | object | No | enabled, flags, stuckSessionWarnMs, otel, cacheTrace |32| `logging` | object | No | level, file, maxFileBytes, consoleLevel, consoleStyle, redactSensitive, redactPatterns |33| `cli` | object | No | banner.taglineMode |34| `update` | object | No | channel (stable/beta/dev), checkOnStart, auto |35| `browser` | object | No | enabled, cdpUrl, headless, profiles, ssrfPolicy, etc. |36| `ui` | object | No | seamColor, assistant.name, assistant.avatar |37| `secrets` | object | No | providers, defaults, resolution |38| `auth` | object | No | profiles, order, cooldowns |39| `acp` | object | No | enabled, dispatch, backend, defaultAgent, allowedAgents, stream, runtime |40| `models` | object | No | mode, providers, bedrockDiscovery |41| `nodeHost` | object | No | browserProxy |42| `agents` | object | No | defaults, list[] |43| `tools` | object | No | web, media, links, sessions, exec, fs, etc. |44| `bindings` | array | No | route and acp bindings |45| `broadcast` | object | No | agent-to-agent broadcast config |46| `audio` | object | No | audio config |47| `media` | object | No | preserveFilenames, ttlHours |48| `messages` | object | No | MessagesSchema |49| `commands` | object | No | CommandsSchema |50| `approvals` | object | No | ApprovalsSchema |51| `session` | object | No | SessionSchema |52| `cron` | object | No | enabled, store, maxConcurrentRuns, retry, webhook, sessionRetention, runLog, failureAlert, failureDestination |53| `hooks` | object | No | enabled, path, token, mappings, gmail, internal, etc. |54| `web` | object | No | enabled, heartbeatSeconds, reconnect |55| `channels` | object | No | ChannelsSchema (all channel types) |56| `discovery` | object | No | wideArea, mdns |57| `canvasHost` | object | No | enabled, root, port, liveReload |58| `talk` | object | No | provider, providers, voiceId, modelId, apiKey, etc. |59| `gateway` | object | No | port, mode, bind, customBindHost, controlUi, auth, tls, http, etc. |60| `memory` | object | No | backend, citations, qmd |61| `mcp` | object | No | servers record (stdio MCP servers) |62| `skills` | object | No | allowBundled, load, install, limits, entries |63| `plugins` | object | No | enabled, allow, deny, load, slots, entries, installs |6465**REJECTED/INVALID ROOT KEYS**: Any key not in the above list will crash the gateway (`.strict()` mode).6667---6869## `agents` schema7071### `agents.defaults`72See AgentDefaultsSchema — same shape as agent entries but all optional.7374### `agents.list[]` item (AgentEntrySchema)75| Key | Type | Required | Notes |76|-----|------|----------|-------|77| `id` | string | **YES** | Unique agent identifier |78| `default` | boolean | No | Is this the default agent? |79| `name` | string | No | Display name |80| `workspace` | string | No | Path to workspace directory |81| `agentDir` | string | No | Alternative: agent directory path |82| `model` | AgentModelSchema | No | Model string or object |83| `skills` | string[] | No | Skill IDs to load |84| `memorySearch` | MemorySearchSchema | No | Memory search config |85| `humanDelay` | HumanDelaySchema | No | mode, minMs, maxMs |86| `heartbeat` | HeartbeatSchema | No | every, activeHours, model, prompt, etc. |87| `identity` | IdentitySchema | No | name, theme, emoji, avatar |88| `groupChat` | GroupChatSchema | No | mentionPatterns, historyLimit |89| `subagents` | object | No | allowAgents, model, thinking |90| `sandbox` | AgentSandboxSchema | No | docker, network, etc. |91| `params` | record | No | Arbitrary key-value params |92| `tools` | AgentToolsSchema | No | Per-agent tool overrides |93| `runtime` | AgentRuntimeSchema | No | Runtime config |9495---9697## `gateway` schema9899| Key | Type | Notes |100|-----|------|-------|101| `port` | int | Gateway port |102| `mode` | "local" \| "remote" | |103| `bind` | "auto" \| "lan" \| "loopback" \| "custom" \| "tailnet" | |104| `customBindHost` | string | **VALID** — use with bind:"custom" |105| `controlUi` | object | enabled, basePath, allowedOrigins, etc. |106| `auth` | object | mode, token, password, rateLimit, trustedProxy |107| `auth.mode` | "none" \| "token" \| "password" \| "trusted-proxy" | |108| `tls` | object | enabled, autoGenerate, certPath, keyPath |109| `tailscale` | object | mode (off/serve/funnel), resetOnExit |110| `remote` | object | url, transport, token, sshTarget, etc. |111| `reload` | object | mode (off/restart/hot/hybrid), debounceMs |112| `http` | object | endpoints (chatCompletions, responses), securityHeaders |113| `push` | object | apns relay config |114| `nodes` | object | browser mode/node, allowCommands, denyCommands |115| `tools` | object | deny, allow arrays |116| `channelHealthCheckMinutes` | int | 0=disabled, default 5 |117| `channelStaleEventThresholdMinutes` | int | Must be >= healthCheckMinutes |118| `channelMaxRestartsPerHour` | int | |119| `trustedProxies` | string[] | |120| `allowRealIpFallback` | boolean | |121122---123124## `channels` schema125Defined in `zod-schema.providers.ts` — includes: telegram, discord, slack, signal, whatsapp, imessage, irc, msteams, googlechat, feishu, webchat, and more.126127---128129## `cron` schema130| Key | Type | Notes |131|-----|------|-------|132| `enabled` | boolean | |133| `store` | string | Storage path |134| `maxConcurrentRuns` | int | |135| `retry` | object | maxAttempts, backoffMs[], retryOn[] |136| `retry.retryOn` | enum[] | rate_limit, overloaded, network, timeout, server_error |137| `webhook` | http url | |138| `webhookToken` | SecretInput | |139| `sessionRetention` | string \| false | Duration string (ms/s/m/h/d) or false |140| `runLog` | object | maxBytes (string/number), keepLines |141| `failureAlert` | object | enabled, after, cooldownMs, mode, accountId |142| `failureDestination` | object | channel, to, accountId, mode |143144---145146## `mcp` schema (NATIVE stdio MCP — not mcporter)147```148mcp:149 servers:150 <server-name>:151 command: string # stdio server command152 args: string[]153 env: record154 cwd: string155 workingDirectory: string156 url: http url # for HTTP-based servers157```158ACP capabilities (http/sse) are `false` — but stdio MCP works via `mcp.servers`.159160---161162## `memory` schema163| Key | Type | Notes |164|-----|------|-------|165| `backend` | "builtin" \| "qmd" | |166| `citations` | "auto" \| "on" \| "off" | |167| `qmd` | object | command, mcporter, searchMode, paths, sessions, update, limits, scope |168| `qmd.searchMode` | "query" \| "search" \| "vsearch" | |169| `qmd.mcporter.enabled` | boolean | Route QMD through mcporter daemon |170171---172173## `skills` schema174| Key | Type | Notes |175|-----|------|-------|176| `allowBundled` | string[] | |177| `load.extraDirs` | string[] | Additional skill dirs |178| `load.watch` | boolean | |179| `install.preferBrew` | boolean | |180| `install.nodeManager` | npm/pnpm/yarn/bun | |181| `limits` | object | maxCandidatesPerRoot, maxSkillsLoadedPerSource, etc. |182| `entries.<id>` | SkillEntrySchema | enabled, apiKey, env, config |183184---185186## `plugins` schema187| Key | Type | Notes |188|-----|------|-------|189| `enabled` | boolean | |190| `allow` | string[] | |191| `deny` | string[] | |192| `load.paths` | string[] | |193| `slots.memory` | string | Plugin ID for memory slot |194| `slots.contextEngine` | string | Plugin ID for context engine slot |195| `entries.<id>` | PluginEntrySchema | enabled, hooks, subagent, config |196| `installs.<id>` | PluginInstallRecordShape | |197198---199200## `secrets` schema201| Key | Type | Notes |202|-----|------|-------|203| `providers.<name>` | SecretProviderSchema | source: env/file/exec |204| `defaults.env` | string | Default env provider alias |205| `defaults.file` | string | Default file provider alias |206| `defaults.exec` | string | Default exec provider alias |207| `resolution` | object | maxProviderConcurrency, maxRefsPerProvider, maxBatchBytes |208209SecretInput type accepts: plain string OR `{ source: "env"/"file"/"exec", provider: string, id: string }`210211---212213## `auth` schema214| Key | Type | Notes |215|-----|------|-------|216| `profiles.<name>` | object | provider, mode (api_key/oauth/token), email |217| `order` | record | provider → auth profile order |218| `cooldowns` | object | billingBackoffHours, failureWindowHours, etc. |219220---221222## `logging` schema223| Key | Type | Notes |224|-----|------|-------|225| `level` | silent/fatal/error/warn/info/debug/trace | |226| `file` | string | Log file path |227| `maxFileBytes` | int | |228| `consoleLevel` | same enum | |229| `consoleStyle` | pretty/compact/json | |230| `redactSensitive` | "off" \| "tools" | |231| `redactPatterns` | string[] | |232233---234235## `update` schema236| Key | Type | Notes |237|-----|------|-------|238| `channel` | "stable" \| "beta" \| "dev" | |239| `checkOnStart` | boolean | |240| `auto.enabled` | boolean | |241| `auto.stableDelayHours` | number | Max 168 |242| `auto.betaCheckIntervalHours` | number | Max 24 |243244---245246## `acp` schema247| Key | Type | Notes |248|-----|------|-------|249| `enabled` | boolean | |250| `dispatch.enabled` | boolean | |251| `backend` | string | |252| `defaultAgent` | string | |253| `allowedAgents` | string[] | |254| `maxConcurrentSessions` | int | |255| `stream` | object | coalesceIdleMs, maxChunkChars, deliveryMode, etc. |256| `runtime.ttlMinutes` | int | |257| `runtime.installCommand` | string | |258259---260261## `diagnostics.otel` schema262| Key | Type | Notes |263|-----|------|-------|264| `enabled` | boolean | |265| `endpoint` | string | |266| `protocol` | "http/protobuf" \| "grpc" | |267| `headers` | record | |268| `traces/metrics/logs` | boolean | |269| `sampleRate` | 0-1 | |270| `flushIntervalMs` | int | |271272---273274## Rejected / Invalid Root Keys275- `mcpServers` — NEVER a root key; use `mcp.servers` instead276- Any unknown key at root level → Zod `.strict()` throws → gateway crash