mirror of
https://github.com/openclaw/openclaw.git
synced 2026-03-12 07:20:45 +00:00
a76e810193
* fix(gateway): harden token fallback and auth reconnect handling * docs(gateway): clarify auth retry and token-drift recovery * fix(gateway): tighten auth reconnect gating across clients * fix: harden gateway token retry (#42507) (thanks @joshavant)
3.3 KiB
3.3 KiB
summary, read_when, title
| summary | read_when | title | ||
|---|---|---|---|---|
| CLI reference for `openclaw devices` (device pairing + token rotation/revocation) |
|
devices |
openclaw devices
Manage device pairing requests and device-scoped tokens.
Commands
openclaw devices list
List pending pairing requests and paired devices.
openclaw devices list
openclaw devices list --json
openclaw devices remove <deviceId>
Remove one paired device entry.
openclaw devices remove <deviceId>
openclaw devices remove <deviceId> --json
openclaw devices clear --yes [--pending]
Clear paired devices in bulk.
openclaw devices clear --yes
openclaw devices clear --yes --pending
openclaw devices clear --yes --pending --json
openclaw devices approve [requestId] [--latest]
Approve a pending device pairing request. If requestId is omitted, OpenClaw
automatically approves the most recent pending request.
openclaw devices approve
openclaw devices approve <requestId>
openclaw devices approve --latest
openclaw devices reject <requestId>
Reject a pending device pairing request.
openclaw devices reject <requestId>
openclaw devices rotate --device <id> --role <role> [--scope <scope...>]
Rotate a device token for a specific role (optionally updating scopes).
openclaw devices rotate --device <deviceId> --role operator --scope operator.read --scope operator.write
openclaw devices revoke --device <id> --role <role>
Revoke a device token for a specific role.
openclaw devices revoke --device <deviceId> --role node
Common options
--url <url>: Gateway WebSocket URL (defaults togateway.remote.urlwhen configured).--token <token>: Gateway token (if required).--password <password>: Gateway password (password auth).--timeout <ms>: RPC timeout.--json: JSON output (recommended for scripting).
Note: when you set --url, the CLI does not fall back to config or environment credentials.
Pass --token or --password explicitly. Missing explicit credentials is an error.
Notes
- Token rotation returns a new token (sensitive). Treat it like a secret.
- These commands require
operator.pairing(oroperator.admin) scope. devices clearis intentionally gated by--yes.- If pairing scope is unavailable on local loopback (and no explicit
--urlis passed), list/approve can use a local pairing fallback.
Token drift recovery checklist
Use this when Control UI or other clients keep failing with AUTH_TOKEN_MISMATCH or AUTH_DEVICE_TOKEN_MISMATCH.
- Confirm current gateway token source:
openclaw config get gateway.auth.token
- List paired devices and identify the affected device id:
openclaw devices list
- Rotate operator token for the affected device:
openclaw devices rotate --device <deviceId> --role operator
- If rotation is not enough, remove stale pairing and approve again:
openclaw devices remove <deviceId>
openclaw devices list
openclaw devices approve <requestId>
- Retry client connection with the current shared token/password.
Related: