OpenClaw v2026.3.31 is the stable release most users should move to now. The single biggest change: qwen-portal-auth is deprecated, and the safe path forward is migrating to Model Studio API keys. If you are still on an older setup, you do not need to panic — but you do need to upgrade carefully, verify your provider settings, and confirm that earlier security fixes are in place.
This guide is written for vibe coders, not infrastructure people. Think of it like moving houses: before you carry in new furniture, you make a backup, label your boxes, and confirm the new keys work. I will walk you through what changed in OpenClaw v2026.3.31, how the Qwen provider migration works, the commands to use, how to test that it worked, and what to check so you are not exposed to old token or WebSocket issues.
If you want background on the beta that introduced these breaking changes, see the earlier OpenClaw v2026.3.28 Beta Release Guide. For this article, we are focused on getting you upgraded safely.
TL;DR: OpenClaw v2026.3.31 stabilizes recent platform updates; the biggest practical change for most users is the Qwen auth migration from qwen-portal-auth to Model Studio API keys.
The headline item in this upgrade guide is not just "new features." It is compatibility plus cleanup. The latest stable version follows a beta cycle that introduced provider changes for Qwen access, while carrying forward improvements like OpenAI WebSocket streaming, Claude 4.6 adaptive thinking support, and native Kubernetes operator features for more advanced teams.
If you are a non-developer, here is the plain-English version. OpenClaw talks to different AI providers the way a travel adapter lets you plug into different wall sockets. In older Qwen setups, one adapter type was called qwen-portal-auth. That adapter is now being retired. The new adapter uses Model Studio API keys, which are more direct and easier to reason about during setup and troubleshooting.
A useful rule: Stable means safer than beta for everyday use, but stable does not mean zero migration work. OpenClaw v2026.3.31 gives you a better landing spot after the breaking change introduced in the beta line.
The OpenSSF's 2024 annual reporting on open source security underscores how much of the modern stack depends on dependencies you did not write yourself, and how easily migration moments turn into exposure moments. That matters here because provider migrations are exactly when people accidentally leave old tokens in place or forget to remove deprecated settings. The recent Anthropic Mythos data leak reported by Fortune on March 26 is a useful reminder: even well-resourced labs get burned by the gap between "we changed the config" and "the old surface is fully gone."
GitHub's 2024 Octoverse report confirmed that AI-assisted development has gone fully mainstream, with a 98% year-over-year surge in generative AI projects on the platform. That means more builders than ever are upgrading tools without a traditional ops background. Your process matters as much as the version number.
If you also use the dashboard heavily, the OpenClaw v2026.3.13 Control UI Guide is still helpful for finding the places where provider settings and health checks appear after the upgrade.
TL;DR: Before upgrading, make a backup, write down your current provider settings, and confirm whether you ever used qwen-portal-auth.
Here is the mistake I see most often: people click upgrade first and ask questions second. Don't do that. Ten minutes of boring preparation keeps the rest of your day calm.
If your OpenClaw install supports the newer backup commands, use them first. If you need a walkthrough, read OpenClaw v2026.3.8: CLI Backup Commands Guide.
At minimum, save:
Think of this like taking photos of every shelf before rearranging a room.
You are affected if any current config, setup notes, or onboarding steps mention:
qwen-portal-authIf you are not sure, ask OpenClaw directly in its assistant panel.
"Please inspect my current provider settings and tell me whether I am still using qwen-portal-auth, older Qwen login-based auth, or a Model Studio API key setup. Show me the exact field names I should review before upgrading."
You want three pieces of information in one note:
| Item | What to record | Why it matters |
|---|---|---|
| Current version | Your exact OpenClaw version | Tells you whether you are crossing the beta breaking-change line |
| Qwen auth method | qwen-portal-auth or Model Studio API key | Determines whether migration is required |
| Security patch status | Whether you already applied recent security updates | Helps you avoid carrying old risk forward |
Use your normal update flow for your install method, then confirm the app reports OpenClaw v2026.3.31 after restart. If your AI coding tool manages the project for you, paste this prompt:
"Upgrade this OpenClaw workspace to v2026.3.31 using the project's existing update method. Before making changes, create a backup or snapshot. After upgrade, show me the exact current version reported by the app and list any warnings related to provider settings."
TL;DR: If deprecated qwen-portal-auth settings exist in your setup, replace them with Model Studio API key authentication and remove the old auth fields completely.
This is the heart of the Qwen provider migration. The beta notes indicated that the old Qwen portal auth path was deprecated, and the migration path uses the onboarding command below:
openclaw onboard --auth-choice modelstudio-api-keyIf you are non-technical, read that command like this: "Open the setup helper, and choose the new Model Studio key method."
openclaw onboard --auth-choice modelstudio-api-keyqwen-portal-auth entries if they still appearDo not copy old auth blocks forward. Use the new pattern instead.
providers:
- name: qwen
auth_type: modelstudio-api-key
api_key: YOUR_MODEL_STUDIO_API_KEY
model: qwen-latestAnd here is the old pattern you should treat as deprecated:
providers:
- name: qwen
auth_type: qwen-portal-auth
portal_session: REMOVE_THIS_OLD_VALUEThe key idea: Deprecated auth fields are not harmless clutter. They create confusion, and sometimes they cause the app to keep trying the wrong door first.
That usually means one of three things:
In plain English: you changed the recipe card on the counter, but the oven is still using the old one taped inside the door.
TL;DR: A successful upgrade means more than "it opens" — confirm the version, test the Qwen provider, and verify you are protected from earlier security issues.
Verification is where most upgrade stress disappears. You are looking for proof, not vibes.
After restart, confirm all of the following:
Use a tiny test first, not a huge workflow.
"Use my Qwen provider and answer with exactly one sentence: 'Upgrade test successful.' If the provider fails, tell me whether the problem is authentication, model selection, or a leftover deprecated setting."
Two earlier issues are worth revisiting after any upgrade:
If you missed either, read OpenClaw v2026.3.11 Security Fix Guide and CVE-2026-25253: Lock Down Your OpenClaw API Tokens Now.
Your quick security checklist:
CISA's general guidance on credential safety emphasizes that removing old credentials matters just as much as creating new ones — especially during migrations.
If you ever pasted a key into chat, notes, or screenshots during troubleshooting, assume that key is burned. Replace it. A key is like a house key: once copied into too many places, it stops being private.
TL;DR: Most issues after upgrading come from stale settings, wrong keys, or testing too many moving parts at once.
Usually the provider loaded, but the old model name or auth method did not carry over. Re-open provider settings and reselect the model after the new key is saved.
That often means the app is still pointing at a leftover qwen-portal-auth field. Search your settings for the word qwen and remove outdated blocks.
If you use Cursor, Replit, Bolt, v0, or Lovable, ask the tool to locate the file currently used at runtime.
"Find the active OpenClaw provider configuration file actually used by this project at runtime. Show me every Qwen-related setting, tell me which ones are deprecated, and propose the smallest safe edit to migrate to modelstudio-api-key."
Restart the app completely. Then test with one provider, one model, and one tiny prompt. If you test five things at once, you will not know which one failed.
| Step | What to do | What you are ruling out |
|---|---|---|
| 1 | Confirm version is v2026.3.31 | Incomplete upgrade |
| 2 | Confirm auth type is modelstudio-api-key | Deprecated auth still active |
| 3 | Paste a fresh API key | Bad or expired key |
| 4 | Test one simple prompt | Workflow complexity |
| 5 | Restart and retry | Cached state |
| 6 | Check security guides | Earlier unresolved issues |
Tomorrow I want to dig into a practical follow-up: how to tell whether a provider issue is really a model problem, a rate-limit problem, or just a bad setting hidden in plain sight. That one saves a lot of wasted time.
No. If your setup never used Qwen, the provider migration does not affect you directly. You should still upgrade to OpenClaw v2026.3.31 for the latest fixes and security patches.
It means OpenClaw is moving away from the older Qwen login-style authentication method. In practice, you should stop relying on that method and switch to Model Studio API keys so your setup matches the current supported path.
Run a small test prompt through your Qwen provider and confirm the response succeeds without auth warnings. Also check that your provider settings explicitly show modelstudio-api-key rather than any older auth method.
It is the right stable target, but you should not assume it erases every past mistake automatically. Review your token hygiene, remove old credentials, and verify you applied or inherited the earlier protections covered in the March security guides.
Ask it to inspect before editing, explain changes in plain English, and show the exact file it plans to modify. The safest prompt asks for the smallest possible change, a backup first, and a verification step after every edit.
OpenClaw upgrades go smoothly when you treat them like a checklist, not a leap of faith. For this release, the big win is getting onto OpenClaw v2026.3.31 while cleaning up the old Qwen authentication path once and for all. Try the migration carefully, keep your test small, and if you know someone else using OpenClaw, share this with them and tell them to come back tomorrow.
Discover more content: