Bug type

Regression (worked before, now fails)

Summary

Control UI accessed over LAN HTTP in 2026.3.12 fails with "device identity required" even when allowInsecureAuth and dangerouslyDisableDeviceAuth are enabled, and the connect request does not include params.auth.token.

Steps to reproduce

1. Run OpenClaw 2026.3.12 in a Docker container
2. Configure gateway with:

• bind: "lan"
• auth.mode: "token"
• valid gateway.auth.token
• gateway.controlUi.allowedOrigins = ["ip"]
• gateway.controlUi.allowInsecureAuth = true
• gateway.controlUi.dangerouslyDisableDeviceAuth = true

3. Restart the container
4. Open ip from another machine on the LAN
5. Enter:

• WebSocket URL: ws://ip
• correct gateway token

6. Click Connect
7. Observe error: device identity required

Expected behavior

Control UI should connect successfully over LAN HTTP when allowInsecureAuth: true and dangerouslyDisableDeviceAuth: true are enabled.

At minimum, the client should send params.auth.token in the connect request and should not fail with device identity required.

Actual behavior

Control UI loads in the browser, but clicking Connect fails with:

• device identity required

The gateway responds to the connect request with:

• NOT_PAIRED
• DEVICE_IDENTITY_REQUIRED

Captured trace shows the request is sent without params.auth and without params.device.

OpenClaw version

2026.3.12

Operating system

Linux

Install method

docker

Model

gpt 5.4

Provider / routing chain

openclaw -> openai

Config file / key location

No response

Additional provider/model setup details

No response

Logs, screenshots, and evidence

{"type":"event","event":"connect.challenge","payload":{"nonce":"366f183e-0f0f-46eb-b64b-5c4411010257","ts":1773438431889}}
{"type":"req","id":"6f86c753-80b7-4387-922b-7002a4a4c0c8","method":"connect","params":{"minProtocol":3,"maxProtocol":3,"client":{"id":"openclaw-control-ui","version":"2026.3.12","platform":"Win32","mode":"webchat","instanceId":"9ebfb0aa-84c6-46a8-a3e6-9c7c2b70fa85"},"role":"operator","scopes":["operator.admin","operator.approvals","operator.pairing"],"caps":["tool-events"],"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36","locale":"cs"}}
{"type":"res","id":"6f86c753-80b7-4387-922b-7002a4a4c0c8","ok":false,"error":{"code":"NOT_PAIRED","message":"device identity required","details":{"code":"DEVICE_IDENTITY_REQUIRED"}}}

Impact and severity

No response

Additional information

No response