设备配对客户端安全读取 TTS 密钥（`config.get includeSecrets`）

解决“移动端已配对但语音模式拿不到 TTS key”场景：PR #14613 为 `config.get` 增加 `includeSecrets` 参数，并限制仅 device-paired 客户端可读取未脱敏配置。

GITHUBDiscovered 2026-02-12Author akramcodez

Prerequisites

Gateway version includes PR #14613 or later.
Your client is paired with a valid device token; unpaired clients should stay redacted.

Steps

Upgrade OpenClaw to a build including PR #14613 and restart gateway during a low-risk window.
From a paired client, call `config.get` with `includeSecrets: true` only for the minimum runtime path that needs TTS keys.
From an unpaired or non-device client, issue the same call and confirm secrets are still redacted.
Audit logs for config reads and keep key rotation runbook for emergency rollback.

Commands

openclaw gateway status

openclaw gateway restart

openclaw status

Verify

Paired device clients can initialize TTS successfully, while non-paired clients cannot retrieve raw secrets.

Caveats

Do not broaden secret scope beyond TTS needs; extra exposure increases blast radius.
Exact request shape may vary by client SDK version（需验证）.

Source attribution

This tip is aggregated from community/public sources and preserved with attribution.