#17279: fix: restore device token priority over config token
gateway
stale
size: XS
trusted-contributor
## Summary
Restores the token priority to storedToken ?? this.opts.token, fixing the device token auth regression in v2026.2.14. Previously paired devices now correctly authenticate via their stored device tokens instead of the shared config token.
## Changes
- Changed token priority in src/gateway/client.ts from this.opts.token ?? storedToken back to storedToken ?? this.opts.token
- Added canFallbackToShared boolean to track when both stored and config tokens are available
- Restored self-healing mechanism in catch handler that clears stale device tokens on connection failure
- Added clearDeviceAuthToken import
## Testing
- TypeScript compilation passes (pnpm tsgo)
- Gateway tests pass (1 pre-existing unrelated failure in server-runtime-config.test.ts)
Fixes openclaw/openclaw#17270
<!-- greptile_comment -->
<h3>Greptile Summary</h3>
Correctly restores device token priority over shared config tokens, fixing a regression where paired devices incorrectly used shared config tokens instead of their device-specific tokens.
- Changed token resolution from `this.opts.token ?? storedToken` back to `storedToken ?? this.opts.token` (src/gateway/client.ts:197)
- Restored self-healing mechanism that clears stale device tokens on connection failure when both tokens are available (src/gateway/client.ts:284-291)
- Added `canFallbackToShared` boolean to track when fallback is possible (src/gateway/client.ts:198)
<h3>Confidence Score: 5/5</h3>
- This PR is safe to merge with minimal risk
- The fix correctly restores the intended token priority logic and self-healing mechanism. The change is well-tested (tests pass), minimal in scope (only affects token selection logic), and addresses a clear regression introduced in a previous commit. The logic is straightforward and properly handles the fallback scenario.
- No files require special attention
<sub>Last reviewed commit: 0f8262b</sub>
<!-- greptile_other_comments_section -->
<!-- /greptile_comment -->
Most Similar PRs
#17379: fix: restore device token priority in device-auth mode
by Limitless2023 · 2026-02-15
90.3%
#15722: fix: prefer explicit token over stored device token for remote gate...
by 0xPotatoofdoom · 2026-02-13
85.5%
#23503: fix: preserve pairing state on device token mismatch + migrate lega...
by dorukardahan · 2026-02-22
84.1%
#16310: fix(ws-connection): skip device pairing when client authenticates w...
by nawinsharma · 2026-02-14
81.7%
#21651: fix(gateway): token fallback + operator.admin scope superset in pai...
by lan17 · 2026-02-20
79.5%
#19885: test(gateway,browser): isolate tests from ambient OPENCLAW_GATEWAY_...
by NewdlDewdl · 2026-02-18
79.4%
#10093: fix: import gateway token from URL param into localStorage
by devjiro76 · 2026-02-06
79.0%
#17336: fix(gateway): restore device token priority over passive config token
by milosm · 2026-02-15
78.9%
#17705: fix(gateway): allow trusted-proxy auth to bypass device-pairing gates
by dashed · 2026-02-16
78.5%
#17378: fix(gateway): allow dangerouslyDisableDeviceAuth with trusted-proxy...
by ar-nadeem · 2026-02-15
78.3%