Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug]: Control UI sends operator/device token to /__openclaw/control-ui-config.json, causing 401 with gateway.auth.mode="token" [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#74450•Fetched 2026-04-30 06:23:52
View on GitHub
Comments
1
Participants
2
Timeline
6
Reactions
2
Author
SszgoSszgo
Participants
clawsweeper[bot]clawsweeper[bot]SszgoSszgo
Timeline (top)
labeled ×2closed ×1commented ×1mentioned ×1

The Control UI uses the operator/device token as the HTTP Authorization: Bearer credential for GET /__openclaw/control-ui-config.json, so the request 401s even when the correct gateway token is configured.

Error Message

GET /__openclaw/control-ui-config.json sends Authorization: Bearer <operator/device token> and returns 401 Unauthorized ({"error":{"message":"Unauthorized","type":"unauthorized"}}).

Root Cause

The Control UI uses the operator/device token as the HTTP Authorization: Bearer credential for GET /__openclaw/control-ui-config.json, so the request 401s even when the correct gateway token is configured.

Fix Action

Fix / Workaround

How I fixed it (workaround / hotfix) I applied a pre-bundle fetch override so every HTTP request to "/__openclaw/*" uses the gateway token, not the operator/device token.

(This is a workaround. The proper upstream fix is to correct token selection in the Control UI HTTP client so /__openclaw/* uses the gateway token by design.)

RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

The Control UI uses the operator/device token as the HTTP Authorization: Bearer credential for GET /__openclaw/control-ui-config.json, so the request 401s even when the correct gateway token is configured.

Steps to reproduce

Configure and run the gateway with gateway.auth.mode="token" and a valid gateway.auth.token. Open the Control UI in a browser (e.g. http://127.0.0.1:18789/). Open DevTools → Network. Observe the request to GET /__openclaw/control-ui-config.json. Check Request Headers → Authorization: it contains the operator/device token (from localStorage["openclaw.device.auth.v1"].tokens.operator.token) instead of the gateway token.

Expected behavior

GET /__openclaw/control-ui-config.json should send Authorization: Bearer <gateway.auth.token> (gateway token) and return 200 with the JSON config.

Actual behavior

GET /__openclaw/control-ui-config.json sends Authorization: Bearer <operator/device token> and returns 401 Unauthorized ({"error":{"message":"Unauthorized","type":"unauthorized"}}).

OpenClaw version

2026.4.22

Operating system

windows 11

Install method

npm

Model

gpt 5.4 / gemma 4

Provider / routing chain

openclaw -> oauth -> codex gpt 5.4 and openclaw -> ollama -> gemma 4 31b

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

i cannot attach any mp3 file created by tts , such as openai tts i cannot attach any local mp3 file

Additional information

i fixed it using cursor:

How I fixed it (workaround / hotfix) I applied a pre-bundle fetch override so every HTTP request to "/__openclaw/*" uses the gateway token, not the operator/device token.

What I changed Edited file: C:\Users\xideo\AppData\Roaming\npm\node_modules\openclaw\dist\control-ui\index.html Change: inserted a new inline <script> before the line that loads ./assets/index-*.js. What the script does Reads the current gatewayUrl from the Control UI settings stored in localStorage (first key starting with openclaw.control.settings.v1). Reads the gateway token from sessionStorage at: openclaw.control.token.v1:<gatewayUrl> Wraps window.fetch and, for any request whose URL contains "/__openclaw/", sets: Authorization: Bearer <gatewayToken> Result / verification After Ctrl+F5, the request:

GET /__openclaw/control-ui-config.json stopped using Bearer U0yv... (operator token) and instead used the gateway token (Bearer e5ac...), returning 200 instead of 401.

(This is a workaround. The proper upstream fix is to correct token selection in the Control UI HTTP client so /__openclaw/* uses the gateway token by design.)

extent analysis

TL;DR

The most likely fix is to modify the Control UI to use the gateway token instead of the operator/device token for requests to /__openclaw/*.

Guidance

  • Verify that the gateway.auth.token is correctly configured and valid.
  • Apply a pre-bundle fetch override to use the gateway token for requests to /__openclaw/*, similar to the provided workaround.
  • Check the localStorage and sessionStorage values to ensure the correct tokens are being stored and retrieved.
  • Consider updating the Control UI HTTP client to correctly select the gateway token for /__openclaw/* requests.

Example

// Inserted script in index.html
const gatewayUrl = localStorage.getItem('openclaw.control.settings.v1');
const gatewayToken = sessionStorage.getItem(`openclaw.control.token.v1:${gatewayUrl}`);

const originalFetch = window.fetch;
window.fetch = function fetchOverride(url, options) {
  if (url.includes('/__openclaw/')) {
    options.headers = {
      ...options.headers,
      Authorization: `Bearer ${gatewayToken}`,
    };
  }
  return originalFetch(url, options);
};

Notes

This workaround may not be suitable for production use and a proper fix should be implemented upstream. The provided example script is based on the workaround described in the issue and may need to be adapted to the specific use case.

Recommendation

Apply the workaround by inserting the script in the index.html file, as it provides a temporary solution to the issue. A proper fix should be implemented upstream to correct the token selection in the Control UI HTTP client.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

GET /__openclaw/control-ui-config.json should send Authorization: Bearer <gateway.auth.token> (gateway token) and return 200 with the JSON config.

#retrieval issue#search optimization#API routing#API middleware#SSR setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING