diff --git a/src/agents/auth-profiles/profiles.test.ts b/src/agents/auth-profiles/profiles.test.ts
index e461abb55a7e..3871aea03b31 100644
--- a/src/agents/auth-profiles/profiles.test.ts
+++ b/src/agents/auth-profiles/profiles.test.ts
@@ -61,14 +61,21 @@ function isPathInsideOrEqual(parentDir: string, candidatePath: string): boolean
   );
 }
 
+function expectOAuthProfileRefId(value: unknown): asserts value is string {
+  expect(typeof value).toBe("string");
+  if (typeof value !== "string") {
+    throw new Error("Expected OAuth profile ref id");
+  }
+  expect(value).toMatch(/^[a-f0-9]{32}$/);
+}
+
 function readPersistedOAuthRefId(agentDir: string, profileId: string): string {
   const persisted = JSON.parse(fs.readFileSync(resolveAuthStorePath(agentDir), "utf8")) as {
     profiles: Record<string, { oauthRef?: { id?: string } }>;
   };
   const refId = persisted.profiles[profileId]?.oauthRef?.id;
-  expect(typeof refId).toBe("string");
-  expect(refId?.length).toBeGreaterThan(0);
-  return String(refId);
+  expectOAuthProfileRefId(refId);
+  return refId;
 }
 
 function resolvePersistedOAuthSecretPath(refId: string): string {
@@ -127,8 +134,7 @@ function expectOpenClawCredentialsOAuthRef(
   const ref = oauthRef as Record<string, unknown>;
   expect(ref.source).toBe("openclaw-credentials");
   expect(ref.provider).toBe(provider);
-  expect(typeof ref.id).toBe("string");
-  expect(String(ref.id).length).toBeGreaterThan(0);
+  expectOAuthProfileRefId(ref.id);
 }
 
 describe("promoteAuthProfileInOrder", () => {
@@ -858,9 +864,8 @@ describe("promoteAuthProfileInOrder", () => {
         profiles: Record<string, { oauthRef?: { id?: string } }>;
       };
       const refId = persisted.profiles[profileId]?.oauthRef?.id;
-      expect(typeof refId).toBe("string");
-      expect(refId?.length).toBeGreaterThan(0);
-      const secretPath = resolvePersistedOAuthSecretPath(String(refId));
+      expectOAuthProfileRefId(refId);
+      const secretPath = resolvePersistedOAuthSecretPath(refId);
       const secretFile = fs.readFileSync(secretPath, "utf8");
       expect(secretFile).not.toContain("delete-access-token");
       expect(secretFile).not.toContain("delete-refresh-token");