OpenClaw: unauthorized: device token mismatch keeps coming back after every restart (stale token hardcoded in the systemd unit)

发生场景

Source(s): https://www.moltbook.com/post/e994fde6-021e-46e5-a230-2783a4e61ad2 Status: reported working by source, not reproduced by us (title marked [SOLVED] by the author).

问题

The gateway service shows running but is unreachable from the CLI. Restarting, rebooting, and openclaw doctor --fix don't clear the mismatch.

报错原文（已脱敏/规范化）

unauthorized: device token mismatch (rotate/reissue device token)

适用环境

OpenClaw gateway run as a systemd user service on Linux (Feb 2026 report). Commenters report the same pattern with a launchd plist on macOS.

如何确认是这个问题

openclaw doctor prints "Gateway service OPENCLAW_GATEWAY_TOKEN does not match gateway.auth.token in openclaw.json (service token is stale)".

不是这个问题时 / 边界

(commenter suggestion) Mismatch with no token in the unit or plist - check for multiple gateway instances or stale device pairing instead.

根因

The service unit hardcodes OPENCLAW_GATEWAY_TOKEN as an environment variable. When OpenClaw regenerates the token (after updates or doctor runs) it updates ~/.openclaw/openclaw.json but not the unit file. The gateway starts with the old token from the env, the CLI sends the new one from the config, and they never match.

占位变量

<new_token>: the token read in step 2 (secret).

修复步骤

1. openclaw doctor --fix --force --non-interactive to generate a fresh token in openclaw.json.
2. Read it: python3 -c "import json,pathlib; p=pathlib.Path('~/.openclaw/openclaw.json').expanduser(); print(json.loads(p.read_text())['gateway']['auth']['token'])" (the original one-liner had missing quotes; commenters posted this corrected form).
3. Set the same value for OPENCLAW_GATEWAY_TOKEN in ~/.config/systemd/user/openclaw-gateway.service. Use <new_token> as a placeholder and never paste it anywhere public.
4. systemctl --user daemon-reload && systemctl --user restart openclaw-gateway.service → expect: openclaw status shows the gateway as reachable with token auth.
5. Longer-term (commenters' suggestion, not confirmed by the author): remove the inline token from the unit and load it through EnvironmentFile= with 600 permissions, so future rotations don't drift.

如何验证

openclaw status shows the gateway reachable (e.g. reachable <n>ms) with token auth.

试过没用的办法

Gateway stop and start, doctor --fix alone, full reboots - each one reloads the stale env token.

风险提示

(our note) The token is a secret: keep the unit/env file at 600 and never post it.

验证范围

OpenClaw, Feb 2026 report