Fix: Web UI Error — missing scope: operator.read

The OpenClaw Web UI makes direct API calls to read session status and agent state. These calls require the operator.read scope. If your key was generated before this scope was introduced, or was created with restricted permissions, you'll see this error on every page load.

What You See

Fix A: Regenerate Your API Key With Operator Scopes

The fastest fix is to regenerate your API key and make sure all operator scopes are selected during creation. Where to do this depends on your model provider:

Fix B: Check Key Type — Personal vs Project Key

Some providers distinguish between personal keys (full access) and project keys (scoped). The Web UI requires scopes that project keys sometimes omit by default.

Fix C: Update openclaw.json With the New Key

After generating a new key, update your config:

{
  "llm": {
    "apiKey": "sk-YOUR-NEW-KEY-HERE",
    "model": "claude-sonnet-4-5"
  }
}

Then restart the gateway:

openclaw gateway restart

Verify the Fix

Open the Web UI and check that session status loads without errors. You can also confirm the key has the right scope from the CLI:

openclaw status --verbose

Look for api_key_scopes: [operator.read, operator.write, ...] in the output. If the key is valid but scopes are missing, the gateway will log a warning on startup.

Still Broken?

Run the Doctor to check key validity and scope configuration automatically: