Summary

openclaw gateway install --force does not remove the embedded OPENCLAW_GATEWAY_TOKEN from the systemd unit, even when gateway.auth.token is migrated to an env SecretRef.

Environment

• OpenClaw 2026.3.28
• Linux / systemd user service
• service file: ~/.config/systemd/user/openclaw-gateway.service

Repro

1. Configure gateway auth token as an env SecretRef in openclaw.json, for example:

{
  "secrets": {
    "providers": {
      "default": { "source": "env" }
    }
  },
  "gateway": {
    "auth": {
      "mode": "token",
      "token": {
        "source": "env",
        "provider": "default",
        "id": "OPENCLAW_GATEWAY_TOKEN"
      }
    }
  }
}

2. Keep OPENCLAW_GATEWAY_TOKEN=... in ~/.openclaw/.env
3. Run:

openclaw gateway install --force
systemctl --user daemon-reload
systemctl --user restart openclaw-gateway.service
openclaw doctor

Expected

The generated systemd unit should not embed:

Environment=OPENCLAW_GATEWAY_TOKEN=...

because the token is already SecretRef-managed via env + EnvironmentFile=%h/.openclaw/.env.

Actual

The generated unit still contains the embedded token line, and openclaw doctor keeps reporting:

• Gateway service embeds OPENCLAW_GATEWAY_TOKEN and should be reinstalled.

Re-running openclaw gateway install --force does not fix it.

Workaround

Manual edit of the generated unit to remove:

Environment=OPENCLAW_GATEWAY_TOKEN=...

followed by daemon reload + restart fixes the doctor warning locally.

Notes

I also saw the service entrypoint migrate from dist/entry.js to dist/index.js during the same maintenance, so the reinstall is partially working — it just keeps writing the stale embedded gateway token.