Why does my token disappear after a page refresh?

For security reasons, OpenClaw does not save your gateway token to browser localStorage. It lives in the active browser tab's memory, which is wiped clean during a full page refresh.

Is this a bug in my configuration?

No. This is a confirmed regression starting in version 2026.3.7 where the UI architecture fails to preserve the auth token during navigation.

Can I persist the token myself to avoid this?

While you could technically patch the source code to store tokens in localStorage, it is not recommended as it bypasses the security intent of the current implementation.

Resolving 'device identity required' Error in OpenClaw

TL;DR — Quick Fix

The error occurs because session links trigger full page reloads that clear the in-memory auth token; avoid clicking links that force a reload until the SPA navigation is patched.

Run Diagnostics

Next Step

Fix now, then reduce repeat incidents

If this issue keeps coming back, validate your setup in Doctor first, then harden your config.

Open Doctor Harden Config

Error Signal

disconnected (1008): device identity required

What's Happening

When you navigate between pages in the OpenClaw Control UI (like switching to the /sessions view or clicking an agent link), your WebSocket connection drops. You see "device identity required" because the browser performs a full page reload. OpenClaw stores your gateway token in-memory for security, so it is wiped clean during these reloads, forcing the dashboard to lose its authentication state.

The Fix

Currently, there is no official point-release fix for this regression. The community identifies this as a routing issue where session links use standard <a href> tags instead of SPA (Single Page Application) navigation methods.

To work around this, avoid navigating away from the initial dashboard URL if possible. If you must navigate, you will need to re-authenticate by manually re-entering your token in the URL fragment: http://127.0.0.1:18789/#token=<your_token>. Do not refresh the page, as this will trigger the same token-loss sequence.

Why This Occurs

The issue stems from a structural change in how the gateway client handles token resolution in version 2026.3.7. The resolvedDeviceToken guard incorrectly drops stored tokens during session link transitions. Because the application logic expects the gateway and device tokens to remain synchronized across the app lifecycle, the full-page reload triggers an identity validation failure in the WebSocket layer.

Prevention

The development team is tracking this in issue #39611. The planned fix involves intercepting standard anchor link clicks to use pushState instead of browser-level navigation, which will keep the JavaScript environment—and the in-memory token—intact. Until an official update is released, monitor the GitHub discussion for backported patches or a new version release that restores SPA navigation behavior.

Last Updated: March 2026

Did this guide solve your problem?