Why does the Browser Relay extension reject my token after upgrading OpenClaw?

OpenClaw changed how the Browser Relay extension authenticates in a recent update. Previously, you pasted the raw gateway.auth.token into the extension Options. Now the extension derives its own token from the gateway /json/version endpoint. If you have an old token saved in the extension, it will be rejected with a 401.

What is the difference between gateway.auth.token and the derived token?

The gateway.auth.token is the raw token set in openclaw.json and used by the gateway itself. The derived token is a session token that the Browser Relay extension obtains by sending the gateway token to /json/version. This two-step flow lets the gateway rotate session tokens without requiring extension reconfiguration.

How do I clear the old token from the Browser Relay extension?

Go to chrome://extensions → find OpenClaw Browser Relay → click Details → Extension options. Clear the token field and click Save. Then reconnect by following the re-pairing steps in this guide.

Fix: Browser Relay Extension Rejects Token After Upgrade

Browser Relay Extension Options: Token rejected (401)
/json/version → 401 Unauthorized (with raw gateway token header)
Extension badge: (!) — cannot attach

After upgrading OpenClaw, the Browser Relay Chrome extension shows a red error badge and cannot attach to browser tabs. The root cause is a token format change: the extension now expects to exchange the gateway token for a derived session token via /json/version, not use the raw token directly. Old tokens stored in the extension Options page are rejected.

Next Step

Fix now, then reduce repeat incidents

If this issue keeps coming back, validate your setup in Doctor first, then harden your config.

Open Doctor Harden Config

Jump to Fix

Clear old token from extension Get derived token from /json/version Re-pair extension with gateway Verify extension attaches

Step 1: Clear the Old Token from the Extension

Open Chrome and go to chrome://extensions
Find OpenClaw Browser Relay and click Details
Click Extension options
Clear the token field completely and click Save

Step 2: Get the Derived Token from Your Gateway

The new flow exchanges your raw gateway token for a session token via the /json/versionendpoint. Do this exchange manually to get the derived token:

Get derived token from gateway

# Replace YOUR_GATEWAY_TOKEN with your gateway.auth.token value
curl -s http://localhost:18789/json/version   -H "Authorization: Bearer YOUR_GATEWAY_TOKEN" | python3 -m json.tool

The response should include a webSocketDebuggerUrl and asessionToken field. Copy the sessionToken value.

If /json/version returns 401 even with the correct gateway token, check that your gateway.auth.token in openclaw.json matches what you are using in the header. A stale token in the config is the most common cause.

Step 3: Re-Pair the Extension

In newer versions of the Browser Relay extension, the re-pairing flow is automatic:

Open the extension Options page (from chrome://extensions)
Enter your gateway URL (default: http://localhost:18789) and gateway.auth.token
Click Connect — the extension now handles the token exchange internally
The badge should turn green

If your extension is older and does not have the Connect flow, paste the derived session token (from Step 2) directly into the token field instead of the raw gateway token.

Restart gateway to reset session state

openclaw gateway restart

# Then re-open the extension options and connect

Step 4: Verify the Extension Attaches

Check extension can attach

# Test CDP endpoint is reachable with your token
curl -s http://localhost:18789/json/version   -H "Authorization: Bearer YOUR_GATEWAY_TOKEN"

# Should return 200 with browser version info — not 401

Once the extension badge turns green and /json/version returns 200, open a browser tab and confirm the relay can attach. Your agent should now be able to control browser tabs via the relay.

Fix It Faster With Our Tools

Config Wizard

Generate a production-ready clawhub.json in 30 seconds.

Local Doctor

Diagnose Node.js, permissions, and config issues instantly.

Cost Simulator

Calculate your agent burn rate before you get surprised.

Skill Finder

Describe your use case and find the right Claude Code skill instantly.

Did this guide solve your problem?

Fix: Browser Relay Extension Rejects Token After Upgrade

Fix now, then reduce repeat incidents

Jump to Fix

Step 1: Clear the Old Token from the Extension

Step 2: Get the Derived Token from Your Gateway

Step 3: Re-Pair the Extension

Step 4: Verify the Extension Attaches

Related browser & auth issues

Browser Control /start Hangs

Remote CDP Port Blocked

Auth & Pairing Errors

Browser Automation Guide

Fix It Faster With Our Tools

Config Wizard

Local Doctor

Cost Simulator

Skill Finder

Next: Make Your Agent Even Better