Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug]: Google Chat webhook returns 401 Unauthorized - all versions 2026.3.23+ [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#57386•Fetched 2026-04-08 01:50:19
View on GitHub
Comments
1
Participants
2
Timeline
7
Reactions
0
Author
kristine-jpgkristine-jpg
Participants
fuzzysbfuzzysbkristine-jpgkristine-jpg
Timeline (top)
subscribed ×3labeled ×2commented ×1mentioned ×1

Google Chat inbound webhooks consistently return 401 Unauthorized despite correct configuration; Google Cloud Logs confirm webhooks reach the endpoint but OpenClaw rejects all requests before JWT verification across versions 2026.3.23, 2026.3.24, and 2026.3.28.

Error Message

  • Google Cloud Logs show: "status code: 401, reason phrase: HTTP error response: HTTP/1.1 401 Unauthorized, Response body: unauthorized"

Google Cloud Error Logs

"error": { "message": "status code: 401, reason phrase: HTTP error response: HTTP/1.1 401 Unauthorized\nResponse body: unauthorized" All configurations result in identical 401 error

  • However, in this installation testing 2026.3.23 also exhibited the 401 error (may be due to new installation vs upgrade) The 401 error occurs BEFORE Google Chat JWT verification runs, suggesting the issue is at the gateway authentication layer rather than the Google Chat-specific token validation. This is evidenced by:
  1. Immediate 401 response with body "unauthorized" (generic gateway auth error)

Root Cause

Google Chat inbound webhooks consistently return 401 Unauthorized despite correct configuration; Google Cloud Logs confirm webhooks reach the endpoint but OpenClaw rejects all requests before JWT verification across versions 2026.3.23, 2026.3.24, and 2026.3.28.

Code Example

### Google Cloud Error Logs
All inbound webhook attempts return 401:

{
  "error": {
    "code": 3,
    "message": "status code: 401, reason phrase: HTTP error response: HTTP/1.1 401 Unauthorized\nResponse body: unauthorized"
  },
  "deploymentFunction": "https://[redacted-domain]/googlechat",
  "deployment": "projects/chat/keys/[redacted]"
}

### OpenClaw Gateway Logs
Gateway starts webhook successfully but shows no incoming request processing:

[googlechat] [default] starting Google Chat webhook
[gateway] listening on ws://127.0.0.1:18789
[gateway] agent model: genspark-llm-proxy/claude-sonnet-4-6

(No further logs when webhook POST arrives - request rejected at gateway level)

### Channel Status
$ openclaw channels status
- Google Chat default: enabled, configured

### Webhook Endpoint Verification
$ curl -X POST https://[redacted-domain]/googlechat -H "Content-Type: application/json" -d '{"type":"MESSAGE"}'
HTTP/2 400
Response: invalid payload

(Proves endpoint is reachable and responding, but rejects valid Google Chat requests with 401)

### Versions Tested
- 2026.3.23: 401 Unauthorized
- 2026.3.24: 401 Unauthorized  
- 2026.3.28: 401 Unauthorized

### Configuration Attempts
✅ audienceType: "app-url" with full URL including /googlechat path
✅ audienceType: "app-url" with domain only (no path)
✅ audienceType: "project-number" with project number
✅ OAuth consent screen configured (Internal)
✅ Multiple gateway restarts
✅ openclaw doctor --yes executed
All configurations result in identical 401 error
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

Google Chat inbound webhooks consistently return 401 Unauthorized despite correct configuration; Google Cloud Logs confirm webhooks reach the endpoint but OpenClaw rejects all requests before JWT verification across versions 2026.3.23, 2026.3.24, and 2026.3.28.

Steps to reproduce

  1. Create Google Cloud project and enable Google Chat API
  2. Create service account and download JSON key
  3. Configure Google Chat app: HTTP endpoint URL, set to LIVE status, enable interactive features
  4. Configure OAuth consent screen (Internal, for Google Workspace)
  5. In OpenClaw: enable googlechat plugin, add channel with service account file
  6. Set audienceType: "app-url", audience: "https://[your-domain]/googlechat"
  7. Restart OpenClaw gateway
  8. Send DM to bot in Google Chat

Expected behavior

Bot should authenticate Google Chat webhook successfully. For unpaired senders, a pairing code should be generated. Bot should either respond or show pairing prompt in Google Chat.

Actual behavior

  • Google Chat displays "Katie Claw not responding"
  • Google Cloud Logs show: "status code: 401, reason phrase: HTTP error response: HTTP/1.1 401 Unauthorized, Response body: unauthorized"
  • No pairing code generated
  • No webhook processing logged in OpenClaw gateway logs
  • Tested with audienceType "app-url" (full URL and domain only) and "project-number" - all fail with 401
  • Issue persists across OpenClaw versions 2026.3.23, 2026.3.24, and 2026.3.28

OpenClaw version

2026.3.28

Operating system

Ubuntu 24.04 LTS

Install method

npm global

Model

genspark-llm-proxy/claude-sonnet-4-6

Provider / routing chain

Google Chat webhook → Caddy (reverse proxy) → OpenClaw gateway (local, port 18789)

Additional provider/model setup details

Gateway Configuration:

  • Mode: local
  • Bind: loopback (127.0.0.1:18789)
  • Auth: token-based
  • Reverse proxy: Caddy with Let's Encrypt SSL
  • Public URL: https://[redacted-domain]/googlechat

Google Chat Channel Config:

  • audienceType: "app-url" (also tested "project-number")
  • audience: "https://[redacted-domain]/googlechat"
  • serviceAccountFile: ~/.openclaw/googlechat-service-account.json
  • webhookUrl: https://[redacted-domain]/googlechat
  • groupPolicy: allowlist
  • streamMode: replace

Google Cloud Project:

  • Project ID: openclaw-chat-[redacted]
  • Project Number: [redacted]
  • Service Account: [service-account]@[project-id].iam.gserviceaccount.com
  • OAuth Consent Screen: Internal (Google Workspace)
  • Chat API: Enabled
  • App Status: LIVE - available to users

Webhook verification:

  • SSL certificate valid (Let's Encrypt)
  • curl to webhook URL returns 405 for GET, 400 for invalid POST (endpoint responding)
  • Google Cloud Logs confirm webhooks ARE being sent to correct URL
  • All requests rejected with 401 before reaching OpenClaw message processing

Logs, screenshots, and evidence

### Google Cloud Error Logs
All inbound webhook attempts return 401:

{
  "error": {
    "code": 3,
    "message": "status code: 401, reason phrase: HTTP error response: HTTP/1.1 401 Unauthorized\nResponse body: unauthorized"
  },
  "deploymentFunction": "https://[redacted-domain]/googlechat",
  "deployment": "projects/chat/keys/[redacted]"
}

### OpenClaw Gateway Logs
Gateway starts webhook successfully but shows no incoming request processing:

[googlechat] [default] starting Google Chat webhook
[gateway] listening on ws://127.0.0.1:18789
[gateway] agent model: genspark-llm-proxy/claude-sonnet-4-6

(No further logs when webhook POST arrives - request rejected at gateway level)

### Channel Status
$ openclaw channels status
- Google Chat default: enabled, configured

### Webhook Endpoint Verification
$ curl -X POST https://[redacted-domain]/googlechat -H "Content-Type: application/json" -d '{"type":"MESSAGE"}'
HTTP/2 400
Response: invalid payload

(Proves endpoint is reachable and responding, but rejects valid Google Chat requests with 401)

### Versions Tested
- 2026.3.23: 401 Unauthorized
- 2026.3.24: 401 Unauthorized  
- 2026.3.28: 401 Unauthorized

### Configuration Attempts
✅ audienceType: "app-url" with full URL including /googlechat path
✅ audienceType: "app-url" with domain only (no path)
✅ audienceType: "project-number" with project number
✅ OAuth consent screen configured (Internal)
✅ Multiple gateway restarts
✅ openclaw doctor --yes executed
All configurations result in identical 401 error

Impact and severity

Affected: All users attempting to configure Google Chat channel with HTTP endpoint webhooks on OpenClaw versions 2026.3.23+

Severity: Blocks workflow - Complete inability to receive inbound Google Chat messages; channel is non-functional despite correct configuration

Frequency: Always - 100% reproduction rate across multiple OpenClaw versions (2026.3.23, 2026.3.24, 2026.3.28), multiple configuration attempts, and multiple gateway restarts

Consequence:

  • All inbound Google Chat messages fail to reach OpenClaw
  • No pairing codes generated for new users
  • Bot appears unresponsive to all Google Chat users
  • Users cannot complete Google Chat channel onboarding
  • Outbound messages via message tool work (not tested in this case but reported by other users with similar issue)
  • Related reports from other users on Discord/AnswerOverflow suggest this is affecting multiple installations

Additional information

Regression Evidence:

  • User report on AnswerOverflow (3 days ago) states: "Was working on 2026.3.23" but fails on 2026.3.24
  • Last known good version: 2026.3.23 (per external report)
  • First known bad version: 2026.3.24 (per external report)
  • However, in this installation testing 2026.3.23 also exhibited the 401 error (may be due to new installation vs upgrade)

Key Diagnostic Finding: The 401 error occurs BEFORE Google Chat JWT verification runs, suggesting the issue is at the gateway authentication layer rather than the Google Chat-specific token validation. This is evidenced by:

  1. Immediate 401 response with body "unauthorized" (generic gateway auth error)
  2. No Google Chat-specific auth errors logged
  3. No entries in OpenClaw logs showing webhook processing attempted

Related Reports: Multiple users reporting identical symptoms on Discord "Friends of the Crustacean" server and AnswerOverflow with versions 2026.3.24+, suggesting widespread issue rather than environment-specific misconfiguration.

Configuration Completeness: All required Google Chat app settings verified correct:

  • App status: LIVE
  • OAuth consent screen: Configured (Internal)
  • Service account: Valid JSON key
  • Webhook URL: Publicly accessible with valid SSL
  • Google Cloud Logs: Confirm webhooks sent successfully Despite comprehensive correct setup, authentication fails universally.

extent analysis

Fix Plan

To resolve the 401 Unauthorized issue with Google Chat webhooks, follow these steps:

  1. Update Gateway Authentication Configuration:

    • Ensure that the audienceType is set to "app-url" and the audience field matches the exact URL of your Google Chat webhook endpoint (including the path, e.g., https://[your-domain]/googlechat).
    • Verify that the service account JSON key file is correctly referenced in the serviceAccountFile field.

  2. Modify OpenClaw Gateway Code:

    • Locate the authentication middleware in the OpenClaw gateway codebase.
    • Update the middleware to correctly handle JWT verification for Google Chat webhooks. This might involve adding a custom authentication handler for Google Chat requests.

Example code snippet ( Node.js ) for a custom authentication handler:

const express = require('express');
const jwt = require('jsonwebtoken');

const app = express();

// Custom authentication handler for Google Chat webhooks
const authenticateGoogleChat = (req, res, next) => {
  const authorizationHeader = req.header('Authorization');
  if (!authorizationHeader) {
    return res.status(401).send('Unauthorized');
  }

  const token = authorizationHeader.split(' ')[1];
  jwt.verify(token, process.env.GOOGLE_CHAT_SECRET_KEY, (err, decoded) => {
    if (err) {
      return res.status(401).send('Invalid token');
    }
    req.user = decoded;
    next();
  });
};

// Apply the custom authentication handler to the Google Chat webhook endpoint
app.post('/googlechat', authenticateGoogleChat, (req, res) => {
  // Handle the webhook request
});

  1. Verify SSL Certificate Configuration:

    • Ensure that the SSL certificate is correctly configured for the reverse proxy (Caddy) and that it matches the domain specified in the audience field.

  2. Restart OpenClaw Gateway:

    • After making the necessary changes, restart the OpenClaw gateway to apply the updates.

Verification

To verify that the fix worked:

  1. Send a test message from Google Chat to the bot.
  2. Check the OpenClaw gateway logs for successful webhook processing.
  3. Verify that the bot responds correctly to the message in Google Chat.

Extra Tips

  • Ensure that the Google Chat app is configured correctly in the Google Cloud Console, including the OAuth consent screen and service account settings.
  • Double-check that the audienceType and audience fields are correctly set in the OpenClaw configuration.
  • If issues persist, enable debug logging in the OpenClaw gateway to gather more detailed error information.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Bot should authenticate Google Chat webhook successfully. For unpaired senders, a pairing code should be generated. Bot should either respond or show pairing prompt in Google Chat.

#api#installation#authentication setup#request error#file not found

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING