openclaw - 💡(How to fix) Fix Android onboarding fails with Tailscale Serve setup code / protocol mismatch

Summary

Android onboarding fails for an OpenClaw gateway advertised through Tailscale Serve. The setup-code payload generated by the CLI uses a valid secure WebSocket URL, but the Android app still does not complete onboarding. A prior/manual gateway entry using an HTTPS URL with the local gateway port produced a protocol mismatch error.

Environment

• OpenClaw CLI: 2026.5.19 (a185ca2)
• Android app: 2026.4.5
• Device: Samsung SM-S928B
• Android: 16 / SDK 36
• Route: Tailscale Serve
• Gateway config observed:
  • gateway.mode: local
  • gateway.bind: loopback
  • gateway.tailscale.mode: serve
  • gateway.auth.mode: token

Observed CLI state

openclaw qr --json reports:

{
  "gatewayUrl": "wss://openclaw.tail4832f5.ts.net",
  "auth": "token",
  "urlSource": "gateway.tailscale.mode=serve"
}

Tailscale Serve reports:

{
  "TCP": { "443": { "HTTPS": true } },
  "Web": {
    "openclaw.tail4832f5.ts.net:443": {
      "Handlers": {
        "/": { "Proxy": "http://127.0.0.1:18789" }
      }
    }
  }
}

openclaw devices list shows existing paired devices only (Paired (3)), with no pending request after the Android attempt.

openclaw nodes status from the local CLI also timed out against the loopback gateway target:

nodes status failed: GatewayTransportError: gateway timeout after 10000ms
Gateway target: ws://127.0.0.1:18789
Source: local loopback
Bind: loopback

Android behavior

Initial final-check screen with a manual gateway address showed exactly:

Gateway error: protocol mismatch

The manual address used at that point was:

https://openclaw.tail4832f5.ts.net:18789

That URL is probably invalid for Tailscale Serve/mobile because the mobile route should use wss:// and no :18789 port when served through Tailscale Serve. However, after generating a fresh setup code whose payload contained wss://openclaw.tail4832f5.ts.net, onboarding still did not complete and no pending pairing request appeared in openclaw devices list.

Expected behavior

For a setup code generated from gateway.tailscale.mode=serve, Android should connect to the advertised wss://... gateway URL, validate the bootstrap token, and create a pending device pairing request on the gateway.

If the user manually enters https://...:18789, the app should ideally reject or normalize it before attempting connection, because the actual mobile gateway endpoint for Tailscale Serve is wss://... on 443.

Notes

I intentionally omitted the generated setup code/bootstrap token from this issue because it is credential-like.