From 37aa0b964e7a8a005958390100769a0c2a76a6c8 Mon Sep 17 00:00:00 2001 From: Shakker Date: Thu, 6 Aug 2026 01:14:44 +0100 Subject: [PATCH] docs: correct dashboard auth precedence (#119785) --- docs/web/dashboard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/web/dashboard.md b/docs/web/dashboard.md index 117663d8a3a8..50af61ae2733 100644 --- a/docs/web/dashboard.md +++ b/docs/web/dashboard.md @@ -87,7 +87,7 @@ Non-goals for v1: - Confirm the gateway is reachable: local `openclaw status`; remote, SSH tunnel `ssh -N -L 18789:127.0.0.1:18789 user@gateway-host` then open `http://127.0.0.1:18789/`. - For `AUTH_TOKEN_MISMATCH`, clients may do one trusted retry with a cached device token when the gateway returns retry hints; that retry reuses the token's cached approved scopes (explicit `deviceToken`/`scopes` callers keep their requested scope set). If auth still fails after that retry, resolve token drift manually. - For `AUTH_SCOPE_MISMATCH`, the device token was recognized but does not carry the requested scopes; re-pair or approve the new scope set instead of rotating the shared gateway token. -- Outside that retry path, connect auth precedence is: explicit shared token/password, then explicit `deviceToken`, then stored device token, then bootstrap token. +- Outside that retry path, the Control UI prefers a pending bootstrap token so a fresh host-issued handoff can create or upgrade the browser credential. Without a pending bootstrap, explicit shared token/password take precedence over the stored device token. - On the async Tailscale Serve path, failed attempts for the same `{scope, ip}` are serialized before the failed-auth limiter records them, so a second concurrent bad retry can already show `retry later`. - For token drift repair steps, see [Token drift recovery checklist](/cli/devices#token-drift-recovery-checklist). - Retrieve or supply the shared secret from the gateway host: