Control UI error: missing scope: operator.read (LAN/IP access)

Symptoms

• Opening the Control UI via a LAN/IP URL (for example, http://<gateway-ip>:18789/) shows Connected on the overview, but other pages show:
  • Error: missing scope: operator.read
• Opening the same gateway via http://127.0.0.1:18789/ works normally.
• This often starts after upgrading OpenClaw (for example, to 2026.2.14).

Cause

In some versions, the Control UI’s auth/scope check can break when the UI is accessed via a non-loopback origin (LAN/IP), even though the gateway is reachable and otherwise healthy. The UI then fails RBAC checks and reports a missing operator.read scope.

Fix

1) Use the loopback URL (recommended)

Open the UI using the tokenized link from:

openclaw dashboard

If the gateway is on another machine, tunnel it and use the loopback URL locally:

ssh -N -L 18789:127.0.0.1:18789 user@host

Then open:

• http://127.0.0.1:18789/?token=...

2) Downgrade to a known-good version (workaround)

If this started after upgrading and you need LAN/IP access immediately, downgrade OpenClaw and restart the gateway.

For npm installs:

npm install -g openclaw@2026.2.13
openclaw gateway restart

Verify

• Open the Control UI and navigate to pages that previously failed (for example, Operators / Sessions / Settings).
• The UI loads data without missing scope: operator.read.

Related

• GitHub issue: #16862