Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix openclaw status shows unreachable (missing scope: operator.read) when using loopback [2 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#52203•Fetched 2026-04-08 01:14:21
View on GitHub
Comments
2
Participants
3
Timeline
3
Reactions
0
Author
KinneyzhangKinneyzhang
Participants
Hollychou924Hollychou924KinneyzhangKinneyzhangmalaiwahmalaiwah
Timeline (top)
commented ×2closed ×1

openclaw status defaults to ws://127.0.0.1 and then reports unreachable (missing scope: operator.read), even though the gateway is healthy and the operator token has operator.read. The status becomes OK only when forcing the CLI to use the LAN URL (with OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1). This feels like a UX bug / confusing auth behavior.

Root Cause

openclaw status defaults to ws://127.0.0.1 and then reports unreachable (missing scope: operator.read), even though the gateway is healthy and the operator token has operator.read. The status becomes OK only when forcing the CLI to use the LAN URL (with OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1). This feels like a UX bug / confusing auth behavior.

RAW_BUFFERClick to expand / collapse

Summary

openclaw status defaults to ws://127.0.0.1 and then reports unreachable (missing scope: operator.read), even though the gateway is healthy and the operator token has operator.read. The status becomes OK only when forcing the CLI to use the LAN URL (with OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1). This feels like a UX bug / confusing auth behavior.

Environment

  • OpenClaw v2026.3.13
  • gateway.bind = lan (0.0.0.0), port 18789
  • gateway.auth.mode = token
  • device-auth.json operator token includes operator.read/admin/write/pairing

Repro

  1. Start gateway on LAN (e.g. 192.168.31.222:18789)
  2. Run openclaw status

Actual

  • Gateway: local · ws://127.0.0.1:18789 · unreachable (missing scope: operator.read)

Expected

  • Status should be reachable (same machine) or should use operator token when probing locally.

Additional notes

  • openclaw gateway call status --token <token> works fine.
  • OPENCLAW_GATEWAY_URL=ws://192.168.31.222:18789 OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1 openclaw status works and shows reachable.

Suggestion

Either:

  • allow device identity (or operator token) for loopback probes, or
  • have openclaw status automatically use gateway.remote.url when gateway.bind=lan, or
  • show a clearer hint to set OPENCLAW_GATEWAY_URL if loopback probe hits scope errors.

extent analysis

Fix Plan

To resolve the issue, we will modify the openclaw CLI to use the gateway.remote.url when gateway.bind=lan. We will also add a clearer hint to set OPENCLAW_GATEWAY_URL if loopback probe hits scope errors.

Code Changes

# In openclaw/cli/status.py
import os

# ...

def get_gateway_url():
    if os.environ.get('OPENCLAW_GATEWAY_URL'):
        return os.environ.get('OPENCLAW_GATEWAY_URL')
    elif gateway.bind == 'lan':
        return f"ws://{gateway.remote.url}:{gateway.port}"
    else:
        return f"ws://127.0.0.1:{gateway.port}"

# ...

def status():
    gateway_url = get_gateway_url()
    # ...
    try:
        # Probe gateway
        # ...
    except Exception as e:
        if 'missing scope' in str(e):
            print(f"Error: {e}. Hint: Set OPENCLAW_GATEWAY_URL or check gateway.bind and gateway.remote.url")
        else:
            print(f"Error: {e}")

Configuration Changes

No configuration changes are required. However, you can set OPENCLAW_GATEWAY_URL environment variable to override the default behavior.

Verification

  1. Run openclaw status without setting OPENCLAW_GATEWAY_URL.
  2. Verify that the status shows "reachable" or a clearer hint to set OPENCLAW_GATEWAY_URL.
  3. Set OPENCLAW_GATEWAY_URL to a valid URL and verify that the status shows "reachable".

Extra Tips

  • Make sure to update the openclaw CLI to the latest version.
  • If you are behind a proxy, ensure that the proxy is configured correctly.
  • You can also use openclaw gateway call status --token <token> as a workaround.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#generation error#database connection#vector store#embedding generation#cache error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING