Device token mismatch persists after gateway restart — agent session caches stale token
✅Solved
After a gateway restart (via systemctl --user restart openclaw-gateway or SIGUSR1), the running agent session retains a stale device token in memory. All gateway API calls
(sessions_spawn, gateway config.get, etc.) fail with:
Steps to reproduce:
1. Have a running agent session (e.g. via Telegram channel)
2. Edit openclaw.json (e.g. add a model provider)
3. Restart gateway via systemctl --user restart openclaw-gateway
4. Agent reconnects but all gateway RPC calls fail with device token mismatch
5. openclaw doctor, openclaw devices rotate, /restart (SIGUSR1) — none fix it
6. Only a full process kill + fresh session resolves it
Expected: Agent session should re-authenticate with fresh device token after gateway restart.
Environment: OpenClaw 2026.2.15, Bazzite (Fedora), systemd user service, Telegram channel, bind: lan
(sessions_spawn, gateway config.get, etc.) fail with:
Steps to reproduce:
1. Have a running agent session (e.g. via Telegram channel)
2. Edit openclaw.json (e.g. add a model provider)
3. Restart gateway via systemctl --user restart openclaw-gateway
4. Agent reconnects but all gateway RPC calls fail with device token mismatch
5. openclaw doctor, openclaw devices rotate, /restart (SIGUSR1) — none fix it
6. Only a full process kill + fresh session resolves it
Expected: Agent session should re-authenticate with fresh device token after gateway restart.
Environment: OpenClaw 2026.2.15, Bazzite (Fedora), systemd user service, Telegram channel, bind: lan
Solution
This is a known bug in 2026.2.15: if the Gateway rejects a connection with
It’s fixed on
- Changelog: “Gateway/Auth: clear stale device-auth tokens after device token mismatch errors so re-paired clients can re-auth” (PR #18201)
1) Stop whatever is doing the reconnect loop (gateway client / agent runner)
2) Move aside the cache file:
If you’re using a non-default state dir, it’s under:
unauthorized: device token mismatch ...It’s fixed on
main- Changelog: “Gateway/Auth: clear stale device-auth tokens after device token mismatch errors so re-paired clients can re-auth” (PR #18201)
Workaround on 2026.2.15 (no upgrade)
On the machine running the client that’s making the RPC calls (often the same host as the gateway, but not always), clear the cached device token:1) Stop whatever is doing the reconnect loop (gateway client / agent runner)
2) Move aside the cache file:
If you’re using a non-default state dir, it’s under:
$OPENCLAW_STATE_DIR/identity/device-auth.json
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
130,529Members
Resources
Was this page helpful?
