openclaw - 💡(How to fix) Fix Installer writes gateway auth token as literal string, causing token mismatch with env-configured CLI

Summary

Fresh installs can write gateway.auth.token as a literal random string in ~/.openclaw/openclaw.json instead of an env-ref, while operators set gateway.remote.token via OPENCLAW_GATEWAY_TOKEN. The result is a silent token mismatch: every CLI call fails with unauthorized: gateway token mismatch until the config is manually repaired.

Environment

• OpenClaw version: 2026.5.7
• Install path: native install via the official one-liner
• Host OS: Ubuntu 24.04

Reproduction

1. Perform a fresh OpenClaw install with the official installer.
2. Set OPENCLAW_GATEWAY_TOKEN in ~/.openclaw/.env to an operator-generated value.
3. Inspect ~/.openclaw/openclaw.json and note that gateway.auth.token may be a literal string instead of an env-ref object.
4. Start the gateway with the env loaded.
5. Run any CLI command such as openclaw status.

Expected

If OPENCLAW_GATEWAY_TOKEN is present, both server and client token config should stay aligned. Fresh installs should not produce an auth mismatch between gateway.auth.token and gateway.remote.token.

Actual

CLI calls fail immediately with:

Error: unauthorized: gateway token mismatch

The gateway is running, but openclaw status reports it as unreachable because the gateway expects the installer-written literal while the CLI presents the env-derived token.

Minimal repro

curl -fsSL https://openclaw.dev/install.sh | bash
jq '.gateway.auth' ~/.openclaw/openclaw.json
grep OPENCLAW_GATEWAY_TOKEN ~/.openclaw/.env
set -a; . ~/.openclaw/.env; set +a
openclaw gateway --bind loopback &
openclaw status

Suggested fix

Any of these would resolve the issue:

• Write both gateway.auth.token and gateway.remote.token as env-refs to OPENCLAW_GATEWAY_TOKEN by default.
• If OPENCLAW_GATEWAY_TOKEN is already set during install, use that value consistently for both sides.
• At minimum, detect and warn when install-time server/client token values diverge.

Notes

This is documented in AoAOS here:

• docs/upstream-bugs/gateway-auth-token-literal-at-install.md