Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug]: exec tool cannot authenticate to gateway in loopback mode [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#59215•Fetched 2026-04-08 02:27:24
View on GitHub
Comments
0
Participants
1
Timeline
2
Reactions
0
Author
rhimmon1rhimmon1
Participants
rhimmon1rhimmon1
Timeline (top)
labeled ×2

Agent's exec tool fails with "pairing required" error when running local commands, even though the same commands work fine from the terminal and gateway auth is set to "none".

Error Message

Gateway status shows running and listening, but RPC probe fails with: "gateway closed (1008): device identity required"

Full error from exec attempts: Exec approval registration failed: Error: gateway closed (1008): pairing required Gateway target: ws://127.0.0.1:18789 Source: local loopback

Root Cause

Agent's exec tool fails with "pairing required" error when running local commands, even though the same commands work fine from the terminal and gateway auth is set to "none".

Code Example

Gateway status shows running and listening, but RPC probe fails with:
"gateway closed (1008): device identity required"

Full error from exec attempts:
Exec approval registration failed: Error: gateway closed (1008): pairing required
Gateway target: ws://127.0.0.1:18789
Source: local loopback
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

Agent's exec tool fails with "pairing required" error when running local commands, even though the same commands work fine from the terminal and gateway auth is set to "none".

Steps to reproduce

  1. Start OpenClaw 2026.4.1 with loopback gateway (gateway.auth.mode = "none")
  2. Attempt to run any command via exec tool (e.g., ollama list)
  3. Observe: "Exec approval registration failed: Error: gateway closed (1008): pairing required"
  4. Run the same command directly from terminal: Works fine
  5. Try again via exec: Still fails with pairing error

Expected behavior

Agent should be able to execute local commands when gateway auth is disabled, matching terminal capabilities.

Actual behavior

All exec commands fail with "pairing required" error, even after:

  • Clearing and regenerating gateway tokens
  • Setting gateway.auth.mode to "none"
  • Running openclaw doctor --fix
  • Multiple gateway restarts

OpenClaw version

2026.4.1 (da64a97)

Operating system

26.4 (25E246)

Install method

npm global

Model

anthropic/claude-haiku-4-5

Provider / routing chain

Agent (Haiku) → OpenClaw exec tool → Local loopback gateway (127.0.0.1:18789) [auth blocked] ⊗ Ollama (127.0.0.1:11434)

Additional provider/model setup details

The exec tool's client-side authentication appears separate from the gateway's auth mode setting. Even with auth disabled, the client tries to authenticate with a device identity that the gateway rejects. This suggests a device identity verification system that cannot be bypassed via config alone.

Suggested fixes:

  1. Make exec client respect gateway.auth.mode = "none" properly
  2. Provide a config option to disable device identity verification for local agents
  3. Document this limitation if it's intentional

Logs, screenshots, and evidence

Gateway status shows running and listening, but RPC probe fails with:
"gateway closed (1008): device identity required"

Full error from exec attempts:
Exec approval registration failed: Error: gateway closed (1008): pairing required
Gateway target: ws://127.0.0.1:18789
Source: local loopback

Impact and severity

Affected users: Anyone using OpenClaw agents with local loopback gateway Severity: High - Blocks agent autonomy (core feature) Frequency: Always (100% reproducible) Consequence: Agents cannot execute local commands; users must manually run all commands from terminal, defeating the purpose of agent autonomy

Additional information

The exec tool's client-side authentication appears separate from the gateway's auth mode setting. Even with auth disabled, the client tries to authenticate with a device identity that the gateway rejects. This suggests a device identity verification system that cannot be bypassed via config alone.

Suggested fixes:

  1. Make exec client respect gateway.auth.mode = "none" properly
  2. Provide a config option to disable device identity verification for local agents
  3. Document this limitation if it's intentional

extent analysis

TL;DR

  • The most likely fix is to modify the exec client to respect the gateway.auth.mode = "none" setting, allowing it to bypass device identity verification for local agents.

Guidance

  • Investigate the exec client's authentication mechanism to understand why it's not respecting the gateway.auth.mode = "none" setting.
  • Consider adding a config option to disable device identity verification for local agents, providing more flexibility in authentication settings.
  • Review the documentation to ensure that any limitations or workarounds related to device identity verification are clearly stated, helping users understand the current functionality and potential restrictions.

Example

  • No specific code snippet can be provided without modifying the existing codebase, but the fix might involve checking the gateway.auth.mode in the exec client and skipping device identity verification when it's set to "none".

Notes

  • The issue seems to stem from a mismatch between the gateway's auth mode setting and the exec client's authentication behavior, highlighting a need for better alignment between these components.
  • The suggested fixes aim to address this mismatch, either by making the exec client respect the gateway's auth mode or by providing a way to disable device identity verification for local agents.

Recommendation

  • Apply workaround: Modify the exec client to respect the gateway.auth.mode = "none" setting, as this directly addresses the identified issue and aligns with the expected behavior of bypassing authentication when it's disabled.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Agent should be able to execute local commands when gateway auth is disabled, matching terminal capabilities.

#database connection#vector store#embedding generation#cache error#pipeline error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix [Bug]: exec tool cannot authenticate to gateway in loopback mode [1 participants]