Summary

When gateway.auth.mode is set to "none" (a documented, valid configuration for trusted local loopback setups), all internal backend RPC connections fail with WebSocket close code 1008: "device identity required". This silently breaks:

• sessions_spawn / subagent spawning from within agent sessions
• In-process gateway tool calls (e.g., config.schema.lookup, config.patch)
• CLI commands that open new connections to the gateway

Existing connections (main session, web UI) continue working because they were established before the gateway restart or reconnected successfully.

Root Cause

In src/gateway/server/ws-connection/handshake-auth-helpers.ts, the shouldSkipLocalBackendSelfPairing function determines whether internal backend RPC connections (from gateway-client / backend mode clients) can skip device identity pairing:

const usesSharedSecretAuth = params.authMethod === "token" || params.authMethod === "password";

When auth.mode: "none", the authMethod resolves to "none" and sharedAuthOk is true (since no auth is needed), but usesSharedSecretAuth evaluates to false because "none" is not in the check. This means the backend self-pairing skip never triggers, forcing device identity checks that the internal spawner does not satisfy.

Reproduction

1. Set gateway.auth.mode to "none" in openclaw.json
2. Restart the gateway
3. Attempt to spawn a subagent or use the gateway tool from an active session
4. Observe: gateway closed (1008): device identity required

Expected Behavior

Internal backend RPC connections on local loopback should skip device identity pairing when auth.mode: "none", since "none" means auth is already satisfied.

Environment

• OpenClaw 2026.4.27
• Linux x64, Node 22.22.2
• gateway.auth.mode: "none", gateway.bind: "loopback"

Workaround

Change gateway.auth.mode from "none" to "token" (keep the existing token in config). This makes usesSharedSecretAuth return true and the backend self-pairing skip works correctly.

Proposed Fix

Add "none" to the usesSharedSecretAuth check:

const usesSharedSecretAuth = params.authMethod === "token" || params.authMethod === "password" || params.authMethod === "none";

PR with fix + tests incoming.

Impact

• "none" is a documented config option ("use only for trusted local loopback setups")
• The error message sends users down the wrong diagnostic path (device pairing issues)
• The failure is silent — no startup warning, no doctor check
• First-time users who skip auth during onboarding will have broken subagents