Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Device private key truncated to 119 chars - WebSocket auth broken [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#60009•Fetched 2026-04-08 02:37:31
View on GitHub
Comments
0
Participants
1
Timeline
0
Reactions
0
Author
wangsen992wangsen992
Participants
wangsen992wangsen992

Error Message

Connect: ok=false Error: {"code":"IDENTITY_SIGNATURE_INVALID","message":"signature verification failed"}

Root Cause

  1. The truncated key appears in both old installations and fresh containers after curl -fsSL https://get.openclaw.ai/install.sh | sh
  2. The claude binary appears to generate the device key, not OpenClaw itself
  3. IPC socket auth (used by openclaw agent) works because it uses deviceToken from device-auth.json, not RSA signature
  4. TCP WebSocket auth requires valid RSA signature with the device private key

Fix Action

Fix / Workaround

  1. Is this a known issue with the claude CLI's device key generation?
  2. Is there a workaround to get a valid device key for WebSocket auth?
  3. Should OpenClaw fall back to token-based auth when device identity is broken?

Code Example

{
  "deviceId": "b613444...",
  "privateKeyPem": "-----BEGIN RSA PRIVATE KEY-----\nM......",  // Only 119 chars total
  "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nM......"  // Full length
}

---

Connect: ok=false
Error: {"code":"IDENTITY_SIGNATURE_INVALID","message":"signature verification failed"}

---

Type: connect.challenge
Challenge received from gateway

Auth attempt:
- Device ID: b613444...
- Private key length: 119 (should be ~1700+ for RSA 2048)
- Signature: computed with truncated key

Response:
{"ok":false,"error":{"code":"IDENTITY_SIGNATURE_INVALID","message":"signature verification failed"}}
RAW_BUFFERClick to expand / collapse

Issue: Device private key truncated - WebSocket RSA auth fails

Problem Description

When attempting to build a custom WebSocket harness for OpenClaw, I discovered that the device private key in ~/.openclaw/identity/device.json is truncated to only 119 characters.

{
  "deviceId": "b613444...",
  "privateKeyPem": "-----BEGIN RSA PRIVATE KEY-----\nM......",  // Only 119 chars total
  "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nM......"  // Full length
}

This causes WebSocket authentication with device identity to fail:

Connect: ok=false
Error: {"code":"IDENTITY_SIGNATURE_INVALID","message":"signature verification failed"}

What Works

  • openclaw agent --session-id ... works fine (spawns subagents, receives results)
  • The claude CLI (via IPC socket) authenticates successfully with the operator token

What Doesn't Work

  • Direct WebSocket client using device identity (RSA signature with truncated key)
  • Custom harness built on gateway WebSocket protocol

Investigation Summary

  1. The truncated key appears in both old installations and fresh containers after curl -fsSL https://get.openclaw.ai/install.sh | sh
  2. The claude binary appears to generate the device key, not OpenClaw itself
  3. IPC socket auth (used by openclaw agent) works because it uses deviceToken from device-auth.json, not RSA signature
  4. TCP WebSocket auth requires valid RSA signature with the device private key

Questions

  1. Is this a known issue with the claude CLI's device key generation?
  2. Is there a workaround to get a valid device key for WebSocket auth?
  3. Should OpenClaw fall back to token-based auth when device identity is broken?

Environment

  • macOS (Darwin 24.x)
  • OpenClaw version: 2026.3.24
  • Node.js: v25.8.2
  • Gateway listening on ws://localhost:18789

Error Details

Type: connect.challenge
Challenge received from gateway

Auth attempt:
- Device ID: b613444...
- Private key length: 119 (should be ~1700+ for RSA 2048)
- Signature: computed with truncated key

Response:
{"ok":false,"error":{"code":"IDENTITY_SIGNATURE_INVALID","message":"signature verification failed"}}

extent analysis

TL;DR

The most likely fix is to regenerate or obtain a valid, non-truncated device private key for WebSocket RSA authentication.

Guidance

  • Investigate the claude CLI's device key generation process to determine why the private key is being truncated to 119 characters.
  • Verify that the device.json file contains a full, valid RSA private key (approximately 1700+ characters for RSA 2048) to ensure successful WebSocket authentication.
  • Consider reaching out to the OpenClaw support team or checking the claude CLI documentation for known issues or workarounds related to device key generation.
  • If possible, test the WebSocket authentication with a manually generated, full-length RSA private key to isolate the issue.

Example

No code snippet is provided as the issue is related to the generation of a device private key, which is not directly solvable with a code example.

Notes

The provided information suggests that the issue is specific to the claude CLI's device key generation and the OpenClaw version 2026.3.24. The solution may involve updating the claude CLI or OpenClaw to a version that fixes the device key generation issue.

Recommendation

Apply a workaround by regenerating or obtaining a valid device private key, as the current truncated key is causing the WebSocket authentication to fail. This approach allows for continued use of the WebSocket protocol while a more permanent solution is investigated.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#installation#integration issue#index setup#retrieval issue#search optimization

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING