QR

text

Copy

openclaw qr

Generate a mobile pairing QR and setup code from your current Gateway configuration.

Usage

bash
Copy
openclaw qr
openclaw qr --setup-code-only
openclaw qr --json
openclaw qr --remote
openclaw qr --url wss://gateway.example/ws

Options

• text

  Copy

  --remote
  : prefer
  text

  Copy

  gateway.remote.url
  ; if it is unset,
  text

  Copy

  gateway.tailscale.mode=serve|funnel
  can still provide the remote public URL
• text

  Copy

  --url <url>
  : override gateway URL used in payload
• text

  Copy

  --public-url <url>
  : override public URL used in payload
• text

  Copy

  --token <token>
  : override which gateway token the bootstrap flow authenticates against
• text

  Copy

  --password <password>
  : override which gateway password the bootstrap flow authenticates against
• text

  Copy

  --setup-code-only
  : print only setup code
• text

  Copy

  --no-ascii
  : skip ASCII QR rendering
• text

  Copy

  --json
  : emit JSON (
  text

  Copy

  setupCode
  ,
  text

  Copy

  gatewayUrl
  ,
  text

  Copy

  auth
  ,
  text

  Copy

  urlSource
  )

Notes

• text

  Copy

  --token
  and
  text

  Copy

  --password
  are mutually exclusive.
• The setup code itself now carries an opaque short-lived
  text

  Copy

  bootstrapToken
  , not the shared gateway token/password.
• In the built-in node/operator bootstrap flow, the primary node token still lands with
  text

  Copy

  scopes: []
  .
• If bootstrap handoff also issues an operator token, it stays bounded to the bootstrap allowlist:
  text

  Copy

  operator.approvals
  ,
  text

  Copy

  operator.read
  ,
  text

  Copy

  operator.talk.secrets
  ,
  text

  Copy

  operator.write
  .
• Bootstrap scope checks are role-prefixed. That operator allowlist only satisfies operator requests; non-operator roles still need scopes under their own role prefix.
• Mobile pairing fails closed for Tailscale/public
  text

  Copy

  ws://
  gateway URLs. Private LAN
  text

  Copy

  ws://
  remains supported, but Tailscale/public mobile routes should use Tailscale Serve/Funnel or a
  text

  Copy

  wss://
  gateway URL.
• With
  text

  Copy

  --remote
  , OpenClaw requires either
  text

  Copy

  gateway.remote.url
  or
  text

  Copy

  gateway.tailscale.mode=serve|funnel
  .
• With
  text

  Copy

  --remote
  , if effectively active remote credentials are configured as SecretRefs and you do not pass
  text

  Copy

  --token
  or
  text

  Copy

  --password
  , the command resolves them from the active gateway snapshot. If gateway is unavailable, the command fails fast.
• Without
  text

  Copy

  --remote
  , local gateway auth SecretRefs are resolved when no CLI auth override is passed:
  • text

    Copy

    gateway.auth.token
    resolves when token auth can win (explicit
    text

    Copy

    gateway.auth.mode="token"
    or inferred mode where no password source wins).
  • text

    Copy

    gateway.auth.password
    resolves when password auth can win (explicit
    text

    Copy

    gateway.auth.mode="password"
    or inferred mode with no winning token from auth/env).
• If both
  text

  Copy

  gateway.auth.token
  and
  text

  Copy

  gateway.auth.password
  are configured (including SecretRefs) and
  text

  Copy

  gateway.auth.mode
  is unset, setup-code resolution fails until mode is set explicitly.
• Gateway version skew note: this command path requires a gateway that supports
  text

  Copy

  secrets.resolve
  ; older gateways return an unknown-method error.
• After scanning, approve device pairing with:
  • text

    Copy

    openclaw devices list
  • text

    Copy

    openclaw devices approve <requestId>

Related

• CLI reference
• Pairing