Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug]: DingTalk connector gets 403 'missing scope: operator.write' when calling gateway API [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#57434•Fetched 2026-04-08 01:49:42
View on GitHub
Comments
1
Participants
2
Timeline
1
Reactions
0
Author
wushicheng123wushicheng123
Participants
lesaailesaaiwushicheng123wushicheng123
Timeline (top)
commented ×1

DingTalk connector successfully connects and creates AI Cards, but fails when calling the gateway streaming API (/v1/chat/completions) with error:

403 - {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}}

Error Message

{"subsystem":"gateway/channels/dingtalk-connector"} "[DingTalk] Gateway 调用失败：Gateway error: 403 - {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}}" Error: Gateway error: 403 - {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}} at streamFromGateway (C:/Users/piece/.openclaw/extensions/dingtalk-connector/plugin.ts:1488:11) at handleDingTalkMessage (C:/Users/piece/.openclaw/extensions/dingtalk-connector/plugin.ts:2891:26)

Root Cause

This appears to be related to issue #27494 where API clients authenticating via shared token (without device identity) have their scopes cleared by clearUnboundScopes() function.

The DingTalk connector uses Bearer token authentication:

headers['Authorization'] = `Bearer ${gatewayAuth}`;

But the gateway doesn't grant operator.write scope to token-authenticated connections without device identity.

Fix Action

Fix / Workaround

Workaround attempted

  • Updated dingtalk-connector from 0.7.9 to 0.8.8 (latest)
  • Verified gatewayToken matches gateway.auth.token
  • Confirmed gateway is running and accessible
  • AI Card creation works, only streaming API calls fail

Code Example

403 - {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}}

---

{
  "gateway": {
    "port": 18789,
    "mode": "local",
    "bind": "loopback",
    "auth": {
      "mode": "token",
      "token": "e374f14b8f2a45425b1775b2fc7df7bd239c0860d409763f"
    }
  },
  "channels": {
    "dingtalk-connector": {
      "enabled": true,
      "clientId": "dingmtt4i1pr8byl530g",
      "clientSecret": "rLfKK1-F0dkPy3dG--msixBGyezpICJ0MOoWLMV2wS6SenUOoM2LQ9U3vkk1h1Rf",
      "gatewayToken": "e374f14b8f2a45425b1775b2fc7df7bd239c0860d409763f"
    }
  },
  "bindings": [
    {
      "type": "route",
      "agentId": "qa-engineer",
      "match": {
        "channel": "dingtalk-connector"
      }
    }
  ]
}

---

[DingTalk][Gateway] POST http://127.0.0.1:18789/v1/chat/completions
  [DingTalk][Gateway] 响应 status=403, ok=false
  [DingTalk][Gateway] 错误响应: {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}}

---

{"subsystem":"gateway/channels/dingtalk-connector"}
"[DingTalk] Gateway 调用失败：Gateway error: 403 - {\"ok\":false,\"error\":{\"type\":\"forbidden\",\"message\":\"missing scope: operator.write\"}}"
Error: Gateway error: 403 - {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}}
    at streamFromGateway (C:/Users/piece/.openclaw/extensions/dingtalk-connector/plugin.ts:1488:11)
    at handleDingTalkMessage (C:/Users/piece/.openclaw/extensions/dingtalk-connector/plugin.ts:2891:26)

---

headers['Authorization'] = `Bearer ${gatewayAuth}`;
RAW_BUFFERClick to expand / collapse

[Bug]: DingTalk connector gets 403 "missing scope: operator.write" when calling gateway API

Bug type

Regression (worked before, now fails) / Authentication issue

Description

DingTalk connector successfully connects and creates AI Cards, but fails when calling the gateway streaming API (/v1/chat/completions) with error:

403 - {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}}

Environment

  • OpenClaw version: 2026.3.28 (f9b1079)
  • DingTalk connector version: 0.8.8
  • OS: Windows 10.0.26200 (x64)
  • Node version: 24.14.0
  • Gateway mode: local (loopback)

Configuration

{
  "gateway": {
    "port": 18789,
    "mode": "local",
    "bind": "loopback",
    "auth": {
      "mode": "token",
      "token": "e374f14b8f2a45425b1775b2fc7df7bd239c0860d409763f"
    }
  },
  "channels": {
    "dingtalk-connector": {
      "enabled": true,
      "clientId": "dingmtt4i1pr8byl530g",
      "clientSecret": "rLfKK1-F0dkPy3dG--msixBGyezpICJ0MOoWLMV2wS6SenUOoM2LQ9U3vkk1h1Rf",
      "gatewayToken": "e374f14b8f2a45425b1775b2fc7df7bd239c0860d409763f"
    }
  },
  "bindings": [
    {
      "type": "route",
      "agentId": "qa-engineer",
      "match": {
        "channel": "dingtalk-connector"
      }
    }
  ]
}

Steps to reproduce

  1. Configure DingTalk connector with gatewayToken matching gateway.auth.token
  2. Start gateway: openclaw gateway start
  3. Send a message to DingTalk bot
  4. Observe AI Card is created successfully
  5. Gateway API call fails with 403 error

Expected behavior

DingTalk connector should be able to call gateway streaming API (/v1/chat/completions) successfully when authenticated with the correct gateway token.

Actual behavior

  • AI Card creation: ✅ Success (status=200)
  • Gateway API call: ❌ 403 Forbidden 
    [DingTalk][Gateway] POST http://127.0.0.1:18789/v1/chat/completions
[DingTalk][Gateway] 响应 status=403, ok=false
[DingTalk][Gateway] 错误响应: {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}}

Error log excerpt

{"subsystem":"gateway/channels/dingtalk-connector"}
"[DingTalk] Gateway 调用失败：Gateway error: 403 - {\"ok\":false,\"error\":{\"type\":\"forbidden\",\"message\":\"missing scope: operator.write\"}}"
Error: Gateway error: 403 - {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}}
    at streamFromGateway (C:/Users/piece/.openclaw/extensions/dingtalk-connector/plugin.ts:1488:11)
    at handleDingTalkMessage (C:/Users/piece/.openclaw/extensions/dingtalk-connector/plugin.ts:2891:26)

Analysis

This appears to be related to issue #27494 where API clients authenticating via shared token (without device identity) have their scopes cleared by clearUnboundScopes() function.

The DingTalk connector uses Bearer token authentication:

headers['Authorization'] = `Bearer ${gatewayAuth}`;

But the gateway doesn't grant operator.write scope to token-authenticated connections without device identity.

Workaround attempted

  • Updated dingtalk-connector from 0.7.9 to 0.8.8 (latest)
  • Verified gatewayToken matches gateway.auth.token
  • Confirmed gateway is running and accessible
  • AI Card creation works, only streaming API calls fail

Related issues

  • #27494 - Operator scopes cleared for API clients authenticating via shared token
  • #50474 - openclaw-cli token auth scope operator.read missing

Request

Please fix the scope authentication for plugin/channel connectors using token auth, or provide documentation on the correct authentication method for DingTalk connector to access gateway APIs.

extent analysis

Fix Plan

To resolve the 403 - missing scope: operator.write error, we need to modify the DingTalk connector to request the operator.write scope when authenticating with the gateway.

Here are the steps:

  • Update the plugin.ts file in the DingTalk connector to include the operator.write scope in the authentication request.
  • Modify the gateway configuration to include the operator.write scope in the token authentication mode.

Code Changes

// In plugin.ts, update the authentication headers to include the scope
headers['Authorization'] = `Bearer ${gatewayAuth}`;
headers['X-Scope'] = 'operator.write'; // Add this line

// Alternatively, you can also modify the gatewayAuth to include the scope
// gatewayAuth = `${gatewayAuth}&scope=operator.write`;

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Verification

To verify that the fix worked:

  1. Restart the gateway and DingTalk connector.
  2. Send a message to the DingTalk bot.
  3. Check the gateway API call response for a successful status code (200).
  4. Verify that the operator.write scope is included in the authentication request headers.

Extra Tips

  • Make sure to update the DingTalk connector to the latest version (0.8.8 or later) to ensure compatibility with the gateway.
  • If you are using a shared token for authentication, ensure that the token has the required scopes, including operator.write.
  • Refer to the OpenClaw documentation for more information on authentication and scope management.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

DingTalk connector should be able to call gateway streaming API (/v1/chat/completions) successfully when authenticated with the correct gateway token.

#api#memory optimization#batch processing#GPU compatibility#authentication issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING