Find, generate, and rotate an OpenClaw Gateway token

Token workflow

1. 1

   Inspect auth mode

   Use redacted status/config output first; do not reveal the token unnecessarily.

   openclaw gateway status --json

   Copy
2. 2

   Show only in an interactive terminal

   The command refuses pipes and redirection to reduce accidental logging.

   openclaw gateway auth-token --show

   Copy
3. 3

   Generate when missing

   This changes configuration; back up first, then restart the Gateway.

   openclaw doctor --generate-gateway-token
   openclaw gateway restart
   openclaw gateway status --require-rpc

   Copy

Rotate after exposure

• Assume compromise if a token appeared in chat, issue text, logs, shell history, a screenshot, or an analytics URL.
• Generate a replacement, restart the Gateway, and update clients one at a time.
• Revoke or delete cached client/device authorization that should not survive the rotation.
• Confirm the old token fails and the expected clients still pass authenticated status checks.