Summary

openclaw doctor reports a false positive for gateway token drift/missing token when the systemd user service loads OPENCLAW_GATEWAY_TOKEN via EnvironmentFile= instead of an inline Environment= entry.

Version

• OpenClaw CLI: 2026.3.2
• OS: Ubuntu 24.04.4 LTS
• Kernel: 6.6.87.2-microsoft-standard-WSL2
• Service type: systemd user service

Repro

1. Put the gateway token in ~/.openclaw/.env:

   OPENCLAW_GATEWAY_TOKEN=...
   

2. Configure the user unit with:

   [Service]
   EnvironmentFile=%h/.openclaw/.env

3. Reference the token in config via env substitution:

   {
     gateway: {
       auth: { token: "${OPENCLAW_GATEWAY_TOKEN}" }
     }
   }

4. Restart the gateway service.
5. Run openclaw doctor.

Actual

doctor reports:

• Gateway service OPENCLAW_GATEWAY_TOKEN does not match gateway.auth.token in openclaw.json
• detail: service token is missing

Expected

If the token is supplied through EnvironmentFile= and the service is healthy, doctor should treat that as valid and not warn about a missing/stale service token.

Notes

In my setup the gateway is healthy and using the token successfully:

• openclaw gateway health returns OK
• the systemd unit has EnvironmentFile=/home/.../.openclaw/.env
• systemctl --user show openclaw-gateway.service -p EnvironmentFiles shows the env file is attached

This looks like doctor only checks inline command.environment.OPENCLAW_GATEWAY_TOKEN and does not account for tokens loaded from EnvironmentFile=.

The relevant logic appears to read only the embedded command environment:

• dist/daemon-cli.js: const serviceToken = command?.environment?.OPENCLAW_GATEWAY_TOKEN?.trim();

So the warning is currently unavoidable for a hardened setup that keeps the token out of the unit file.