Problem

When a gateway is behind Cloudflare Zero Trust (or similar reverse proxy with auth), openclaw node run cannot connect because the WebSocket handshake gets a 302 redirect to the auth page. There's no way to pass custom HTTP headers on the WebSocket connection.

Current workaround

SSH tunnels to bypass Cloudflare, then connect to localhost. This works but adds operational complexity (tunnel management, auto-reconnect, extra services).

Proposed solution

Add a repeatable --header flag to openclaw node run and openclaw node install:

openclaw node run --host gateway.example.com --port 443 --tls \
  --header "CF-Access-Client-Id:abc123" \
  --header "CF-Access-Client-Secret:xyz789" \
  --display-name "Remote Node"

Headers would be included in the initial WebSocket upgrade request.

Alternatively, support CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET env vars, or a generic OPENCLAW_NODE_HEADERS env var.

Use case

Bidirectional node pairing between two OpenClaw gateways, both behind Cloudflare Zero Trust tunnels. Each gateway is a node on the other, enabling symmetric remote exec and diagnostics. Without header support, SSH tunnels are required as an intermediary.

Environment

• OpenClaw 2026.3.8
• Both gateways behind Cloudflare Tunnel + Zero Trust Access apps
• openclaw node run --tls returns Unexpected server response: 302