Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Feature]: doctor/status should warn when OPENCLAW_GATEWAY_TOKEN in ~/.openclaw/.env overrides gateway.auth.token [1 pull requests, 3 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#74271•Fetched 2026-04-30 06:26:21
View on GitHub
Comments
3
Participants
3
Timeline
13
Reactions
2
Author
grzesiolplgrzesiolpl
Participants
clawsweeper[bot]clawsweeper[bot]grzesiolplgrzesiolplmartingarramonmartingarramon
Timeline (top)
subscribed ×5commented ×3cross-referenced ×2labeled ×1

Warn users when a stale OPENCLAW_GATEWAY_TOKEN in ~/.openclaw/.env overrides gateway.auth.token in local gateway mode.

Error Message

Warn users when a stale OPENCLAW_GATEWAY_TOKEN in ~/.openclaw/.env overrides gateway.auth.token in local gateway mode. When detected, warn that env credentials override config and may be stale.

  • Warn that env credentials override config and may be stale

Root Cause

Because OPENCLAW_GATEWAY_TOKEN takes precedence over gateway.auth.token, some local auth/probe paths used the stale env token while others used the config token.

Fix Action

Fixed

PR fix notes

PR #74433: fix(doctor): warn when OPENCLAW_GATEWAY_TOKEN env overrides gateway.auth.token config

Description (problem / solution / changelog)

Summary

Fixes #74271

When both OPENCLAW_GATEWAY_TOKEN (environment) and gateway.auth.token (config) are set, CLI commands (status, call, probe) use env-first precedence while the gateway server uses config-first. If the values differ, CLI commands silently fail to authenticate.

Changes

  • Added warning in noteSecurityWarnings() when both env and config tokens are set, explaining the precedence divergence
  • Added SecurityAuditFinding with checkId: "gateway.env_token_overrides_config" in auditGatewayConfig for openclaw security audit --deep
  • 2 new tests: warning appears on conflict, no warning for env-only

Changed files

  • src/commands/doctor-security.test.ts (modified, +23/-0)
  • src/commands/doctor-security.ts (modified, +12/-0)
  • src/security/audit-gateway-config.ts (modified, +15/-0)
RAW_BUFFERClick to expand / collapse

Summary

Warn users when a stale OPENCLAW_GATEWAY_TOKEN in ~/.openclaw/.env overrides gateway.auth.token in local gateway mode.

Problem to solve

After updating OpenClaw, my local gateway entered a confusing split-brain auth state.

I had gateway.auth.token configured in ~/.openclaw/openclaw.json, but ~/.openclaw/.env also contained OPENCLAW_GATEWAY_TOKEN. I did not manually set this env token; it appears to have been created or left by OpenClaw setup/update/install flow.

Because OPENCLAW_GATEWAY_TOKEN takes precedence over gateway.auth.token, some local auth/probe paths used the stale env token while others used the config token.

This caused confusing symptoms:

  • gateway token mismatch
  • health/Dashboard/CLI auth disagreement
  • gateway status sometimes showed reachable/admin-capable
  • openclaw health failed with token mismatch or timeout
  • Dashboard connected but messages were stuck/spinning
  • Discord/WhatsApp behavior was inconsistent until the stale env token was removed

Current behavior is insufficient because the gateway can look partially healthy while different local clients disagree on auth. The stale ~/.openclaw/.env token was not obvious until manually checking env precedence.

Proposed solution

Add a diagnostic guardrail in doctor/status that detects this condition:

  • gateway.mode is local
  • gateway.auth.token is configured in ~/.openclaw/openclaw.json
  • ~/.openclaw/.env contains a non-empty OPENCLAW_GATEWAY_TOKEN

When detected, warn that env credentials override config and may be stale.

The warning should:

  • not print the token or any secret
  • mention the source path ~/.openclaw/.env
  • explain that OPENCLAW_GATEWAY_TOKEN overrides gateway.auth.token
  • suggest removing or syncing OPENCLAW_GATEWAY_TOKEN
  • suggest restarting the gateway afterward

Ideally surface this in:

  • openclaw doctor
  • openclaw status / status --all
  • openclaw gateway status --deep
  • gateway install/update flows when auth token rotation or service reinstall happens

Alternatives considered

Manually checking ~/.openclaw/.env works, but users are unlikely to know that this file can override openclaw.json.

Automatically deleting the env token may be too aggressive because some users may intentionally use env-based auth.

A warning is safer: it preserves existing behavior, does not expose secrets, and points users to the exact source of the mismatch.

Impact

Affected users/systems/channels: Local OpenClaw users running the gateway in local mode with token auth, especially after update/install/onboarding flows that rotate or recreate gateway.auth.token.

Severity: High when it occurs, because it can block Dashboard, health checks, CLI probes, and channels while still making the gateway look partially healthy.

Frequency: Intermittent / post-update edge case, but very hard to diagnose when it happens.

Consequence: Users can spend a long time debugging token mismatch, health timeouts, Dashboard hangs, and inconsistent Discord/WhatsApp behavior. The fix is simple once found, but the current diagnostics do not clearly point to stale ~/.openclaw/.env credentials.

Evidence/examples

Observed on:

  • OpenClaw 2026.4.26 (be8c246)
  • macOS 15.2 x64
  • Node 24.15.0
  • local loopback gateway on 127.0.0.1:18789

Relevant findings:

  • ~/.openclaw/openclaw.json had gateway.auth.token configured
  • ~/.openclaw/.env contained OPENCLAW_GATEWAY_TOKEN
  • removing OPENCLAW_GATEWAY_TOKEN / OPENCLAW_GATEWAY_PASSWORD / OPENCLAW_GATEWAY_URL from ~/.openclaw/.env and restarting the gateway fixed the auth mismatch

Symptoms before removing the stale env token:

  • gateway token mismatch
  • openclaw health failed with token mismatch or timeout
  • gateway status sometimes showed reachable/admin-capable
  • Dashboard connected but agent messages were stuck/spinning
  • Discord/WhatsApp behavior was inconsistent

No secrets should be printed in diagnostics; just showing that OPENCLAW_GATEWAY_TOKEN is set in ~/.openclaw/.env would have been enough.

Additional information

This was debugged with help from the OpenClaw Discord with Krill.

Suggested acceptance criteria:

  • Detect local gateway mode + configured gateway.auth.token + non-empty OPENCLAW_GATEWAY_TOKEN in ~/.openclaw/.env
  • Do not print either secret
  • Warn that env credentials override config and may be stale
  • Suggest removing/syncing OPENCLAW_GATEWAY_TOKEN in ~/.openclaw/.env
  • Suggest restarting the gateway
  • Surface the warning in doctor, status, and ideally install/update flows

extent analysis

TL;DR

To resolve the auth mismatch issue, remove the stale OPENCLAW_GATEWAY_TOKEN from ~/.openclaw/.env and restart the gateway.

Guidance

  • Check for the presence of OPENCLAW_GATEWAY_TOKEN in ~/.openclaw/.env when running the gateway in local mode with token auth.
  • Verify that gateway.auth.token is configured in ~/.openclaw/openclaw.json.
  • Remove or sync OPENCLAW_GATEWAY_TOKEN in ~/.openclaw/.env to resolve the auth mismatch.
  • Restart the gateway after making changes to ~/.openclaw/.env.
  • Run openclaw doctor or openclaw status to detect and warn about the stale env token.

Example

No code snippet is necessary for this issue, as the solution involves modifying environment variables and configuration files.

Notes

This issue is specific to local OpenClaw users running the gateway in local mode with token auth, especially after update/install/onboarding flows that rotate or recreate gateway.auth.token.

Recommendation

Apply the workaround by removing the stale OPENCLAW_GATEWAY_TOKEN from ~/.openclaw/.env and restarting the gateway, as this is a safer and more straightforward solution that preserves existing behavior and does not expose secrets.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#request error#file not found#serialization error#model compatibility#GPU setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Feature]: doctor/status should warn when OPENCLAW_GATEWAY_TOKEN in ~/.openclaw/.env overrides gateway.auth.token [1 pull requests, 3 comments, 3 participants]