allowInsecureAuth Ignored Behind Docker / Reverse Proxy

You deployed OpenClaw in Docker behind Nginx/Traefik/Caddy. You set allowInsecureAuth: true and configured a token. But the Control UI still demands device pairing, or rejects your token with "token_missing" or "Gateway token rejected."

What the Error Looks Like

When accessing the Control UI through your reverse proxy:

The critical clue is the IP address in the logs: 172.18.0.1 (or similar Docker bridge IP) instead of 127.0.0.1. The gateway sees the proxy's IP, not your actual client IP.

Why This Happens

The Fix: Add trustedProxies

Add trustedProxies to your gateway config. This tells the gateway to trust X-Forwarded-For headers from your proxy, making the connection appear as "local" to the auth handler.

{
  "gateway": {
    "mode": "local",
    "bind": "lan",
    "port": 18789,
    "trustedProxies": ["0.0.0.0/0"],
    "controlUi": {
      "enabled": true,
      "allowInsecureAuth": true
    },
    "auth": {
      "mode": "token",
      "token": "your-secure-token-here"
    }
  }
}

# If running in Docker
docker compose restart openclaw-gateway

# If running directly
openclaw gateway restart

Config Examples by Platform

Docker Compose + Nginx

services:
  openclaw-gateway:
    image: openclaw/openclaw:latest
    volumes:
      - ./clawdbot.json:/app/clawdbot.json
    ports:
      - "18789:18789"  # Only needed if not using nginx proxy_pass
    networks:
      - openclaw-net

  nginx:
    image: nginx:alpine
    ports:
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/conf.d/default.conf
      - ./certs:/etc/nginx/certs
    networks:
      - openclaw-net

Unraid / StartOS

On Unraid and StartOS, the Docker network uses a custom bridge. Add the bridge subnet to trustedProxies instead of 0.0.0.0/0:

"trustedProxies": ["172.16.0.0/12"]

Tailscale / WireGuard VPN

"trustedProxies": ["100.64.0.0/10"]  // Tailscale CGNAT range

Security Considerations

Verify Token Auth Works

Still Stuck?

If you still get pairing prompts after adding trustedProxies, check that your config file is actually being loaded:

# Check which config file the gateway is using
openclaw config path

# Dump the effective gateway config
openclaw config get gateway

# Check if trustedProxies is present in the output
openclaw config get gateway.trustedProxies

Common gotcha: the Docker container might mount a different clawdbot.json than the one you edited. Verify with docker exec openclaw-gateway cat /app/clawdbot.json.