OpenClaw "device pairing required" / browser auth 401
The gateway treats connections arriving through Docker NAT (such as 172.18.0.1) as external, and external clients need a device-pairing step a headless browser can't complete; a token mismatch after a partial upgrade causes the same prompt. Approve the pending device - set "silent": true in pending.json so the request surfaces - rather than bypassing auth, and check openclaw.json's token against your credentials directory.
Likely cause
The gateway treats connections coming through Docker NAT (such as 172.18.0.1) as external, and external clients need a device-pairing step a headless browser can't complete. A token mismatch after a partial upgrade causes the same prompt.
The fix
- 1 Approve the pending device rather than bypassing auth: edit pending.json to set "silent": true so the suppressed request surfaces, then approve it normally.
- 2 For a token mismatch, compare the token in openclaw.json against your credentials directory.
- 3 Restart the gateway.
openclaw gateway restartHit a different error?
Paste any agent error and get the cause and fix in seconds.
Frequently asked questions
Why does a local Docker container count as an external device?
The container reaches the gateway through Docker's NAT address (e.g. 172.18.0.1), which the gateway sees as a non-local origin, so it demands device pairing. Approving the pending device, not disabling auth, is the right fix.
The pairing prompt never appears, so I can't approve it. What now?
It's being suppressed. Edit pending.json and set "silent": true so the request surfaces, then approve it normally. Avoid bypassing auth entirely - that leaves the gateway open.
It started after an upgrade. Could it be a token mismatch?
Yes. A partial upgrade can leave the token in openclaw.json out of sync with your credentials directory, triggering the same 401. Compare the two and align them, then restart the gateway.
Stop firefighting agent errors
Decoding errors one at a time is the manual version of what BetterClaw automates. Run your OpenClaw agents hosted with managed models, retries and config validation built in.
$19/month per agent · BYOK · 7-day money-back guarantee