In This Article
Introduction
OpenClaw's device-pairing system issues scoped tokens to approved users. Each paired device receives a token that grants access only to its designated session. Tokens can be revoked individually if a device is lost or compromised. This replaces the deprecated auth-none mode and provides granular access control.
Device pairing was introduced in 2026.2.17 as part of the security hardening. It addresses the 135K exposed instances problem: many of those instances ran with no authentication. Device pairing ensures every connection is authenticated and revocable. This article explains how it works and how to use it. See OpenClaw security for the full picture.
How It Works
User initiates pairing from new device (e.g., new phone for Telegram). Gateway generates pairing code. User enters code in OpenClaw config or pairing UI. Gateway issues token, bound to device ID and session. Token stored on device. Future requests include token; Gateway validates.
Flow: (1) User opens pairing UI or runs openclaw pair. (2) Gateway displays a 6-digit code (or QR code). (3) User enters code on the new device. (4) Gateway validates, issues token. (5) Token is stored (in config, keychain, or secure storage). (6) All future requests from that device include the token. (7) Gateway checks token on each request. Invalid or revoked = rejected.
Scoped Tokens
Each token: device ID, session ID, expiry (optional). Token grants access only to that session. Cannot access other users' sessions or other devices' sessions. Reduces blast radius: compromise of one device doesn't expose all.
Scoping means: if an attacker steals your phone and gets the token, they can only access that device's session. They can't access your laptop's session or another user's data. The token is bound to the device that paired. Moving the token to another device (e.g., copying the config file) may work in some implementations — the Foundation is tightening this. Best practice: treat tokens as device-bound. Don't share config files across devices.
Revocation
Lost phone? Revoke that device's token. Other devices unaffected. Revocation list in Gateway; checked on each request. Immediate effect. Essential for enterprise and high-sensitivity deployments.
How to revoke: OpenClaw admin UI or CLI. List paired devices. Select the lost device. Revoke. The token is added to the revocation list. The next request from that device fails. The user must re-pair if they recover the device. No downtime for other devices.
Migration from auth-none
If you were running with auth-none, migrate to device pairing: (1) Upgrade to 2026.2.17+. (2) Run openclaw pair or use the pairing UI. (3) Pair each device you use. (4) Verify all devices work. (5) auth-none is deprecated — it will be removed in a future release. Migrate before that.
Enterprise Use
For enterprises: device pairing integrates with MDM (mobile device management). When a device is wiped or offboarded, revoke its token. For SSO deployments (roadmap), device pairing may be supplemented or replaced by SSO tokens. The principle remains: scoped, revocable access. See enterprise OpenClaw.
Wrapping Up
Device pairing is the Foundation's answer to auth-none. Scoped tokens, individual revocation, enterprise-ready. See Gateway and security.