What does OpenClaw Control UI requires device identity mean?

It means the browser dashboard connection did not present an approved device identity or trusted remote path, so the gateway rejected the WebSocket session.

Is allowedOrigins enough to fix device identity required errors?

No. allowedOrigins controls which browser origins may connect. Device identity and pairing are separate checks that still apply to remote or non-loopback dashboards.

Should I expose OpenClaw Control UI on public HTTP?

No. Use localhost, an SSH tunnel, HTTPS with explicit allowed origins, Tailscale with the expected identity behavior, or managed hosting.

Usage Tips

OpenClaw "Control UI requires device identity" fix for VPS and remote dashboards

Problem statement: you opened the OpenClaw dashboard from a VPS, LAN IP, hosting-provider button, HTTPS proxy, or Tailscale route and the WebSocket closes with 1008 or Control UI requires device identity. This is not just a random token problem. Secure browser context, origin allowlisting, gateway URL, pairing, and browser device identity are separate layers.

Fast answer

For quick local access, open http://127.0.0.1:18789/ or use an SSH tunnel back to localhost. For real remote access, use HTTPS or Tailscale with explicit gateway.controlUi.allowedOrigins, then complete device pairing when required. Do not expose a public unauthenticated Control UI or use wildcard origins as a production fix.

What the error means

The Control UI is served by the OpenClaw gateway and communicates over WebSocket. Local loopback browser connections are treated differently from remote LAN, VPS, or public HTTP connections. A new browser/device generally needs a stable device identity and one-time approval. If the browser cannot present that identity, or if the gateway does not trust the route, the connection can fail with a policy close such as 1008.

Fix path by setup

Same machine: open http://127.0.0.1:18789/ or http://localhost:18789/. Avoid switching between localhost, LAN IP, and a public hostname while debugging.
Remote VPS: use an SSH tunnel to localhost, or put HTTPS in front of the gateway and add the exact browser origin to gateway.controlUi.allowedOrigins.
Tailscale Serve: keep the browser identity requirement in mind. Tailscale can provide a trusted route only when identity verification and browser device identity expectations are met.
Hosted or managed: prefer a route that keeps gateway URL, token handling, HTTPS, allowed origins, and device identity expectations stable across restarts.

Stop babysitting your OpenClaw box

Fix it once — or stop fixing it for good.

Apply the checklist above and keep self-hosting, or skip the maintenance entirely: run your OpenClaw on managed hosting from $6.90/mo, starting with a 7-day free trial. We handle the stale locks, gateway restarts, version upgrades, and uptime — and you can import your existing instance in a couple of minutes. Cancel anytime.

Managed hosting — from $6.90/mo Your own hosted OpenClaw instance with automatic restarts and version upgrades. Starts with a 7-day free trial — import your current setup, keep your channels, cancel anytime.

$199 managed setup — optional Prefer we do it for you? One workspace configured end-to-end: first-run config, one 30-minute onboarding/debug session, and a 7-day follow-up. Limited weekly slots.

Managed hosting handles stale .jsonl.lock files, gateway restarts, and version upgrades for you
Import your existing OpenClaw setup in minutes — keep your channels and configuration
The optional $199 setup is scoped: no custom development, enterprise/SRE support, or unsupported self-hosting repair

If you would rather compare options first, review OpenClaw cloud hosting or see the best OpenClaw hosting options before deciding.

Run it on managed hosting — from $6.90/mo Prefer we set it up? $199 managed setup Keep self-hosted: apply fix checklist

OpenClaw import first screen in OpenClaw Setup dashboard (light theme) — 1) Paste import payload

OpenClaw import first screen in OpenClaw Setup dashboard (dark theme) — 1) Paste import payload

OpenClaw import completed screen in OpenClaw Setup dashboard (light theme) — 2) Review and launch

OpenClaw import completed screen in OpenClaw Setup dashboard (dark theme) — 2) Review and launch

What not to do

Do not set allowedOrigins = ["*"] for production remote access.
Do not assume a hosting provider dashboard button supplies OpenClaw device identity.
Do not disable device authentication as the first fix.
Do not mix public HTTP, HTTPS, IP access, localhost, and Tailscale hostnames in the same debug run.

Verification checklist

openclaw gateway status shows the dashboard URL you intend to use.
The browser URL uses localhost for local access or HTTPS/WSS for remote access.
The exact browser origin appears in gateway.controlUi.allowedOrigins for public non-loopback deployments.
openclaw devices list and approval flow handle the first browser/device pairing when required.
Gateway logs no longer show device identity required, origin not allowed, or repeated unauthorized loops.

Managed hosting option

If your team is moving from a laptop install to a VPS, Lobsterland gives you a managed OpenClaw route with HTTPS, dashboard wiring, restart-safe config, and stable remote access expectations.

See OpenClaw cloud hosting Open dashboard