fix device pairing

Dockerfile

@@ -47,6 +47,7 @@ ENV OPENCLAW_CONTROL_UI_BASE_PATH=/openclaw
 ENV OPENCLAW_ALLOWED_ORIGINS=https://researchengineering-agi-assistant.hf.space,http://127.0.0.1:7860,http://localhost:7860
 ENV OPENCLAW_TRUSTED_PROXIES=127.0.0.1,::1
 ENV OPENCLAW_CONTROL_UI_ALLOW_INSECURE_AUTH=1
+ENV OPENCLAW_CONTROL_UI_DISABLE_DEVICE_AUTH=1
 
 RUN mkdir -p /app/vault /app/.openclaw/state
 

scripts/bootstrap_gateway_token.py

@@ -32,6 +32,13 @@ def main() -> int:
         "yes",
         "on",
     }
+    disable_device_auth = os.getenv("OPENCLAW_CONTROL_UI_DISABLE_DEVICE_AUTH", "1").strip() in {
+        "1",
+        "true",
+        "True",
+        "yes",
+        "on",
+    }
 
     state_path = Path("/app/.openclaw/state/openclaw.json")
     state_path.parent.mkdir(parents=True, exist_ok=True)
@@ -61,6 +68,8 @@ def main() -> int:
     control_ui["basePath"] = control_ui_base_path
     control_ui["allowedOrigins"] = allowed_origins
     control_ui["allowInsecureAuth"] = allow_insecure_auth
+    # Break-glass for reverse-proxied hosted setups that cannot complete pairing reliably.
+    control_ui["dangerouslyDisableDeviceAuth"] = disable_device_auth
     gateway["controlUi"] = control_ui
     gateway["trustedProxies"] = trusted_proxies
 
@@ -74,6 +83,7 @@ def main() -> int:
         f" allowedOrigins={allowed_origins}"
         f" trustedProxies={trusted_proxies}"
         f" allowInsecureAuth={allow_insecure_auth}"
+        f" dangerouslyDisableDeviceAuth={disable_device_auth}"
     )
     return 0