Fix: Device Token Mismatch After Upgrading to v2026.2.15+

Getting unauthorized: device token mismatch (rotate/reissue device token) after upgrading OpenClaw? You're not alone—this is a common issue when upgrading from versions before v2026.2.15.

The Problem

After updating from an older version (like v2026.2.9) to v2026.2.15 or later, all gateway-dependent tool calls fail with:

Your agent connects but immediately gets rejected on device authentication. Commands like cron, sessions_list, and subagent operations all fail.

Why This Happens

The v2026.2.15 release included a security improvement:

Security/Pairing: generate 256-bit base64url device and node pairing tokens and use byte-safe constant-time verification (#16535)

Your old device identity was created with the previous hex-format tokens. The new verification logic in v2026.2.15+ rejects these old-format tokens, but the gateway doesn't automatically migrate them.

The Fix

Option 1: Update to v2026.2.17+ (Recommended)

The latest version (v2026.2.17) includes automatic migration for old-format tokens. Simply update and restart:

npm install -g openclaw@latest
openclaw gateway restart

If that doesn't work, run the doctor command:

openclaw doctor --fix

Option 2: Full Identity Reset (Nuclear Option)

If updating alone doesn't work, you may need to reset your device identity completely:

# Stop the gateway
openclaw gateway stop

# Backup and remove old identity files
mv ~/.openclaw/identity ~/.openclaw/identity.bak
mv ~/.openclaw/devices ~/.openclaw/devices.bak

# Restart - this will generate new tokens
openclaw gateway start

You'll need to re-pair any connected nodes after this.

What Doesn't Work

Community members have tried these approaches that don't fix the issue:

• ❌ Just rotating gateway.auth.token in openclaw.json
• ❌ Deleting only device-auth.json
• ❌ Clearing only paired.json and pending.json
• ❌ Simple gateway restarts without updating

The token format itself changed, so you need either the automatic migration (v2026.2.17+) or a complete identity regeneration.

Verification

After applying the fix, verify your gateway is working:

openclaw status

You should see a healthy connection without the device token mismatch error.

Discovered via the OpenClaw Discord #help forum—thanks to the community members who reported this issue!