solution web-ui high macos linux windows

Control UI shows 'unauthorized' / keeps reconnecting

Fix OpenClaw dashboard/control UI auth errors (unauthorized, 1008, reconnect loop) by aligning gateway token/password and reachability.

By CoClaw Team • February 3, 2026

Symptoms

The Control UI says “unauthorized”, or it connects then immediately disconnects / reconnects.
You open http://127.0.0.1:18789/ and see unauthorized.
You see close code 1008.

Cause

The gateway has auth enabled, but the browser is not sending credentials that match the gateway entrypoint you are actually reaching.

Common causes:

You opened the UI without the one-time ?token=... link.
Your browser cached an old token in localStorage.
Your gateway token is being overridden by an environment variable (e.g. OPENCLAW_GATEWAY_TOKEN).
You are connecting to a remote host without an SSH tunnel / tailnet bind, so you are not actually reaching the gateway you think you are.

If you need the full trust model instead of the short fix, the primary companion pages are /guides/control-ui-auth-and-pairing, /guides/openclaw-remote-dashboard-access-playbook, and /channels/webchat.

Branch before changing auth config:

What you see	Use this path
`unauthorized`, `token missing`, or close code `1008` with auth text	Continue here and get a fresh tokenized dashboard link.
`device identity required`	Use /troubleshooting/solutions/control-ui-device-identity-required.
`pairing required` for a new browser/device	Use /troubleshooting/solutions/control-ui-pairing-required.
`reason=scope-upgrade` after update/reinstall	Use /troubleshooting/solutions/gateway-pairing-required-scope-upgrade.

Fix

1) Get a fresh tokenized link (fastest)

openclaw dashboard

Open the URL it prints (it should include ?token=...).

2) Verify the gateway is reachable

openclaw status

If the gateway is remote, tunnel it first:

ssh -N -L 18789:127.0.0.1:18789 user@host

Then open:

http://127.0.0.1:18789/?token=...

3) Check token source only after reopening from the dashboard command

Use the tokenized URL from openclaw dashboard first. Do not treat a manual browser setting as the primary recovery path unless the current Control UI auth guide tells you to use that location for your installed version.

If the fresh link still fails, compare the token source the gateway is using with the environment that starts the service. Common token sources include config and OPENCLAW_GATEWAY_TOKEN.

If you suspect an env override, run:

openclaw doctor

Look for notes about launchd/systemd environment overrides.

Verify

Reload the Control UI; it should stay connected.
openclaw status --deep succeeds.

GitHub issues: search for similar reports (for example: unauthorized 1008).
Docs: Dashboard auth notes and Control UI auth troubleshooting (see links above).
Deeper guide: /guides/control-ui-auth-and-pairing
Remote access playbook: /guides/openclaw-remote-dashboard-access-playbook
Device identity branch: /troubleshooting/solutions/control-ui-device-identity-required
Pairing branch: /troubleshooting/solutions/control-ui-pairing-required