There should be a first-party setup path for the extension when `gateway.auth.token` is SecretRef-managed. Any of these would solve it cleanly: 1. a CLI helper that resolves the configured gateway token and copies it for extension setup 2. a browser-extension install/setup command that provisions the token for the extension 3. a local authenticated bootstrap path that lets the extension obtain the relay token without asking the user to recover plaintext manually

openclaw - 💡(How to fix) Fix Browser Relay extension setup breaks when gateway.auth.token is SecretRef-managed [1 comments, 2 participants]

openclaw2026-03-13 00:03:45

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#44463•Fetched 2026-04-08 00:46:35

View on GitHub

Comments

Participants

Timeline

Reactions

Author

mickobizzle

Participants

joshavant

mickobizzle

Timeline (top)

closed ×1commented ×1locked ×1

When gateway.auth.token is migrated from plaintext config to a SecretRef, the Browser Relay server still works, but the Chrome/Brave extension setup flow becomes incomplete.

The relay auth path can resolve gateway.auth.token from SecretRefs, but the browser extension still expects a literal plaintext token in its own local storage (chrome.storage.local.gatewayToken). After hardening gateway auth to use a SecretRef, the extension prompts for a token and cannot discover it through first-party setup.

Error Message

In particular, the extension relies on chrome.storage.local.gatewayToken and treats a missing value as an error.

Root Cause

When gateway.auth.token is migrated from plaintext config to a SecretRef, the Browser Relay server still works, but the Chrome/Brave extension setup flow becomes incomplete.

Code Example

{
  "gateway": {
    "auth": {
      "mode": "token",
      "token": {
        "source": "exec",
        "provider": "macos-keychain",
        "id": "gateway-shared-token"
      }
    }
  }
}

---

openclaw browser extension token

RAW_BUFFERClick to expand / collapse

Summary

When gateway.auth.token is migrated from plaintext config to a SecretRef, the Browser Relay server still works, but the Chrome/Brave extension setup flow becomes incomplete.

Reproduction

Configure local gateway auth with a SecretRef-backed token, for example:

{
  "gateway": {
    "auth": {
      "mode": "token",
      "token": {
        "source": "exec",
        "provider": "macos-keychain",
        "id": "gateway-shared-token"
      }
    }
  }
}

Start/restart the gateway successfully.
Install/load the OpenClaw Browser Relay extension in Chrome or Brave.
Open the extension options page.
Observe that it requires Gateway token to be manually pasted.
If that field is empty, relay auth fails even though the local gateway is healthy and able to resolve the SecretRef.

Expected behavior

There should be a first-party setup path for the extension when gateway.auth.token is SecretRef-managed.

Any of these would solve it cleanly:

a CLI helper that resolves the configured gateway token and copies it for extension setup
a browser-extension install/setup command that provisions the token for the extension
a local authenticated bootstrap path that lets the extension obtain the relay token without asking the user to recover plaintext manually

Actual behavior

Gateway relay auth works with SecretRef-backed gateway.auth.token
Extension setup still depends on a plaintext token stored in browser-local extension storage
The user experience after hardening is: browser relay appears broken and asks for a token again

Evidence from current code paths

Relevant behavior appears split between these areas:

Relay auth can resolve SecretRefs:
- src/browser/extension-relay-auth.ts
Extension options/background still use plaintext browser-local storage:
- assets/chrome-extension/options.js
- assets/chrome-extension/background.js
- assets/chrome-extension/background-utils.js

In particular, the extension relies on chrome.storage.local.gatewayToken and treats a missing value as an error.

Impact

This makes SecretRef adoption incomplete for users who rely on Browser Relay.

The gateway itself is hardened correctly, but the browser-extension flow regresses into a manual plaintext handoff that is easy to miss and feels like a broken relay.

Suggested fix

A minimal improvement would be a first-party CLI command specifically for browser extension setup, for example:

openclaw browser extension token

That command could:

resolve gateway.auth.token from config/env/SecretRef
copy it to clipboard
print short setup instructions for the extension options page

Longer-term, a tighter first-party bootstrap flow for the extension would be even better.

Environment

OpenClaw: 2026.3.11-beta.1 local build
OS: macOS 15 / Apple Silicon
Browser: Brave
Gateway mode: local
Gateway auth: gateway.auth.mode = "token"
Gateway token source: SecretRef via exec provider backed by macOS Keychain

extent analysis

Fix Plan

To resolve the issue, we will implement a CLI command to simplify the browser extension setup process. The command will:

Resolve the gateway.auth.token from the config, environment, or SecretRef
Copy the token to the clipboard
Print setup instructions for the extension options page

Here are the steps to implement the fix:

Create a new CLI command openclaw browser extension token that:
- Resolves the gateway.auth.token using the existing SecretRef resolution logic
- Copies the resolved token to the clipboard
- Prints setup instructions for the extension options page
Update the assets/chrome-extension/options.js to handle the case where the token is not stored in chrome.storage.local.gatewayToken

Example code for the CLI command:

# openclaw browser extension token command
openclaw browser extension token () {
  # Resolve gateway.auth.token from config/env/SecretRef
  token=$(openclaw config get gateway.auth.token)

  # Copy token to clipboard
  echo "$token" | pbcopy

  # Print setup instructions
  echo "Token copied to clipboard. Please paste it into the extension options page."
}

Example code for updating the extension options page:

// assets/chrome-extension/options.js
// ...

// Check if token is stored in chrome.storage.local.gatewayToken
chrome.storage.local.get('gatewayToken', (result) => {
  if (!result.gatewayToken) {
    // If token is not stored, prompt user to paste it
    console.log('Token not stored. Please paste it into the input field.');
  } else {
    // If token is stored, use it to authenticate
    authenticateWithToken(result.gatewayToken);
  }
});

// ...

Verification

To verify the fix, follow these steps:

Run the openclaw browser extension token command
Verify that the token is copied to the clipboard
Open the extension options page and verify that the token is pre-filled or can be pasted into the input field
Verify that the extension can authenticate successfully using the token

Extra Tips

Consider implementing a tighter first-party bootstrap flow for the extension in the long term
Ensure that the SecretRef resolution logic is secure and follows best practices for handling sensitive data.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

FAQ

Expected behavior

There should be a first-party setup path for the extension when gateway.auth.token is SecretRef-managed.

Any of these would solve it cleanly:

a CLI helper that resolves the configured gateway token and copies it for extension setup
a browser-extension install/setup command that provisions the token for the extension
a local authenticated bootstrap path that lets the extension obtain the relay token without asking the user to recover plaintext manually

#api #ssr #installation #tensor shape #autograd error #pipeline error #runtime error #dependency conflict #environment setup #docker error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

openclaw - 💡(How to fix) Fix Browser Relay extension setup breaks when gateway.auth.token is SecretRef-managed [1 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Code Example

Summary

Reproduction

Expected behavior

Actual behavior

Evidence from current code paths

Impact

Suggested fix

Environment

extent analysis

Fix Plan

Verification

Extra Tips

FAQ

Expected behavior

Still need to ship something?

TRENDING

openclaw - 💡(How to fix) Fix Browser Relay extension setup breaks when gateway.auth.token is SecretRef-managed [1 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Code Example

Summary

Reproduction

Expected behavior

Actual behavior

Evidence from current code paths

Impact

Suggested fix

Environment

extent analysis

Fix Plan

Verification

Extra Tips

FAQ

Expected behavior

Still need to ship something?

RELATED_DISCOVERY

TRENDING