Persistent device token mismatch after fresh install
β
Solved
β gateway rejects its own internal agent connection
Environment:
β’ OpenClaw 2026.2.15 (3fe22ea)
β’ Ubuntu 24.04, Node 22.22.0
β’ Gateway mode: local, bind: loopback, auth: token
Problem:
Every WebSocket connection to the gateway fails with:
unauthorized: device token mismatch (rotate/reissue device token)
This affects:
β’ CLI commands (openclaw status, openclaw devices list, openclaw doctor)
β’ The browser tool (from inside the agent session)
β’ The gateway's own internal agent client (client=gateway-client, clientDisplayName=agent)
The only command that works is passing --token explicitly:
openclaw devices list --token "<gateway-auth-token>" #
works
openclaw devices list #
device token mismatch
What we tried (in order):
1. openclaw devices rotate β rotated the device token via --token flag. No effect.
2. gateway restart (SIGUSR1) β no effect.
3. gateway stop + gateway start (full restart) β no effect.
4. Deleted identity/device-auth.json + devices/paired.json, restarted gateway β files regenerated with matching tokens, still fails.
5. Deleted identity/device-auth.json + identity/device.json + devices/paired.json (full identity wipe), restarted β new device ID + new token generated, pairing created, tokens match across both files. Still fails.
6. openclaw configure (full reconfigure) β new gateway auth token generated, new pairing created. Still fails.
7. openclaw gateway install --force + restart β no effect.
Key observation:
After every attempt, device-auth.json and devices/paired.json contain matching device IDs and tokens. Yet the gateway still rejects the connection. The gateway logs confirm authReason: "device_token_mismatch" even for its own internal agent connection (client=gateway-client).
This suggests the gateway is comparing the device token against something other than paired.json, or there's a caching/state issue that survives full process restarts.
Any ideas? Happy to provide more logs or config details.
Environment:
β’ OpenClaw 2026.2.15 (3fe22ea)
β’ Ubuntu 24.04, Node 22.22.0
β’ Gateway mode: local, bind: loopback, auth: token
Problem:
Every WebSocket connection to the gateway fails with:
unauthorized: device token mismatch (rotate/reissue device token)
This affects:
β’ CLI commands (openclaw status, openclaw devices list, openclaw doctor)
β’ The browser tool (from inside the agent session)
β’ The gateway's own internal agent client (client=gateway-client, clientDisplayName=agent)
The only command that works is passing --token explicitly:
openclaw devices list --token "<gateway-auth-token>" #
worksopenclaw devices list #
device token mismatchWhat we tried (in order):
1. openclaw devices rotate β rotated the device token via --token flag. No effect.
2. gateway restart (SIGUSR1) β no effect.
3. gateway stop + gateway start (full restart) β no effect.
4. Deleted identity/device-auth.json + devices/paired.json, restarted gateway β files regenerated with matching tokens, still fails.
5. Deleted identity/device-auth.json + identity/device.json + devices/paired.json (full identity wipe), restarted β new device ID + new token generated, pairing created, tokens match across both files. Still fails.
6. openclaw configure (full reconfigure) β new gateway auth token generated, new pairing created. Still fails.
7. openclaw gateway install --force + restart β no effect.
Key observation:
After every attempt, device-auth.json and devices/paired.json contain matching device IDs and tokens. Yet the gateway still rejects the connection. The gateway logs confirm authReason: "device_token_mismatch" even for its own internal agent connection (client=gateway-client).
This suggests the gateway is comparing the device token against something other than paired.json, or there's a caching/state issue that survives full process restarts.
Any ideas? Happy to provide more logs or config details.
Solution
If you want, I can:
- review the outputs of openclaw gateway status --deep --json and the sanitized logs you paste, and point to the exact mismatch; or
- give the exact copy/chown commands to sync files once you paste the service state dir + service user.
Summary checklist (short)
- Run openclaw gateway status --deep --token "<token>" and check Config (cli) vs Config (service)
- Check service environment for OPENCLAW_STATE_DIR / OPENCLAW_HOME / any gateway token envs
- Compare identity/device-auth.json + devices/paired.json under both state dirs (do not paste tokens)
- If mismatch, copy files to the service state dir or set OPENCLAW_STATE_DIR in the service, chown to service user, restart
- If still failing, paste sanitized gateway-status --deep JSON + small log excerpt and Iβll dig deeper
If you paste the outputs (redact token strings if you need), Iβll point exactly to whatβs being read and the minimal fix.
- review the outputs of openclaw gateway status --deep --json and the sanitized logs you paste, and point to the exact mismatch; or
- give the exact copy/chown commands to sync files once you paste the service state dir + service user.
Summary checklist (short)
- Run openclaw gateway status --deep --token "<token>" and check Config (cli) vs Config (service)
- Check service environment for OPENCLAW_STATE_DIR / OPENCLAW_HOME / any gateway token envs
- Compare identity/device-auth.json + devices/paired.json under both state dirs (do not paste tokens)
- If mismatch, copy files to the service state dir or set OPENCLAW_STATE_DIR in the service, chown to service user, restart
- If still failing, paste sanitized gateway-status --deep JSON + small log excerpt and Iβll dig deeper
If you paste the outputs (redact token strings if you need), Iβll point exactly to whatβs being read and the minimal fix.
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
131,281Members
Resources
Was this page helpful?
