Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: device.token.rotate returns plaintext device tokens in gateway RPC response [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#66773•Fetched 2026-04-15 06:24:24
View on GitHub
Comments
0
Participants
1
Timeline
4
Reactions
0
Author
ai-hpcai-hpc
Participants
ai-hpcai-hpc
Timeline (top)
labeled ×2cross-referenced ×1referenced ×1

The gateway device.token.rotate method returns the newly rotated device token directly in the success payload. That means the fresh credential is exposed to any websocket/RPC client handling the response and can be captured by client logs, browser devtools, session transcripts, or proxy instrumentation. The behavior may be intentional for provisioning, but it still creates a secret-exposure sink in the control plane.

Root Cause

The gateway device.token.rotate method returns the newly rotated device token directly in the success payload. That means the fresh credential is exposed to any websocket/RPC client handling the response and can be captured by client logs, browser devtools, session transcripts, or proxy instrumentation. The behavior may be intentional for provisioning, but it still creates a secret-exposure sink in the control plane.

Fix Action

Fixed

PR fix notes

PR #66794: fix: redact device token from rotate response

Description (problem / solution / changelog)

Summary

Prevents plaintext device tokens from being returned in `device.token.rotate* gateway RPC responses.

Root Cause

device.token.rotate\* in src/gateway/server-methods/devices.ts* returned the full plaintext bearer token in the success payload. This exposed credentials to websocket traffic, browser devtools, client logs, session transcripts, and proxy instrumentation.

Fix

Return `[REDACTED]* instead of the raw token value. The rotation still succeeds server-side; the caller knows the rotation was requested. Clients that need the token can retrieve it through secure out-of-band mechanisms.

Closes openclaw#66773

Changed files

  • src/gateway/server-methods/devices.ts (modified, +1/-1)

Code Example

{
  "deviceId": "target-device",
  "role": "operator"
}

---
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

The gateway device.token.rotate method returns the newly rotated device token directly in the success payload. That means the fresh credential is exposed to any websocket/RPC client handling the response and can be captured by client logs, browser devtools, session transcripts, or proxy instrumentation. The behavior may be intentional for provisioning, but it still creates a secret-exposure sink in the control plane.

Steps to reproduce

  1. Connect to the gateway with a client that has operator.pairing or operator.admin scope and permission to manage the target device.
  2. Call device.token.rotate with a payload like:
{
  "deviceId": "target-device",
  "role": "operator"
}
  1. Inspect the successful RPC response payload.
  2. Observe that the response contains the full new token value in plaintext.

Expected behavior

The gateway should avoid returning long-lived or bearer-style credentials in normal RPC responses unless there is an explicit one-time bootstrap flow with stronger handling expectations. Safer options would be:

  • return only metadata and require an out-of-band retrieval flow, or
  • return the token only in a clearly isolated bootstrap/provisioning path with stricter UX/logging controls.

Actual behavior

device.token.rotate` returns a success payload containing:

  • deviceId
  • role
  • full plaintext token
  • scopes
  • `rotatedAtMs

OpenClaw version

2026.4.14

Operating system

Ubuntu 24.04

Install method

No response

Model

Not model-specific

Provider / routing chain

client / Control UI / websocket client -> OpenClaw gateway -> device.token.rotate handler -> device token rotation -> plaintext success payload returned to caller

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

extent analysis

TL;DR

Modify the device.token.rotate method to return only metadata, such as a token ID or a URL for out-of-band retrieval, instead of the full plaintext token.

Guidance

  • Review the device.token.rotate method implementation to identify where the plaintext token is being returned and modify it to return a safer alternative, such as a token ID or a URL for out-of-band retrieval.
  • Consider implementing an explicit one-time bootstrap flow with stronger handling expectations for returning long-lived or bearer-style credentials.
  • Evaluate the need for stricter UX/logging controls in the control plane to prevent secret exposure.
  • Assess the impact of this change on existing clients and workflows, and plan for potential updates or workarounds.

Example

{
  "deviceId": "target-device",
  "role": "operator",
  "tokenId": "new-token-id",
  "retrievalUrl": "https://example.com/token/retrieve"
}

Notes

The exact implementation details may vary depending on the specific requirements and constraints of the system. It is essential to carefully evaluate the trade-offs between security, usability, and compatibility when designing a solution.

Recommendation

Apply a workaround by modifying the device.token.rotate method to return only metadata, as this approach balances security and usability without requiring a full system overhaul.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

The gateway should avoid returning long-lived or bearer-style credentials in normal RPC responses unless there is an explicit one-time bootstrap flow with stronger handling expectations. Safer options would be:

  • return only metadata and require an out-of-band retrieval flow, or
  • return the token only in a clearly isolated bootstrap/provisioning path with stricter UX/logging controls.
#serialization error#model compatibility#GPU setup#container setup#orchestration issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: device.token.rotate returns plaintext device tokens in gateway RPC response [1 pull requests, 1 participants]