On this page
On this page
CLI commands
Pair
openclaw pair
Approve a browser that is showing a pairing code. Choose Pair this browser in the Control UI to get a code. See Pair a browser with a code.
The command prints what the Gateway knows about the requesting browser, then asks before approving:
Address is the peer the Gateway saw. Rows marked (reported) come from the requester, so treat them as hints. Compare Browser ID with the one on the page in front of you.
Approve only a code you requested yourself. Anyone can display a code, and approving one someone sent you gives their browser administrator control of your Gateway. Answering no tells the browser it was declined.
Approving pairs the browser the same way openclaw devices approve would: it becomes an operator device with the Control UI's administrator scopes, and your own connection must hold those scopes. It appears in openclaw devices list and the Devices page. To end its access, run openclaw devices remove <deviceId>.
If that browser is already paired and its operator token was revoked or rotated to fewer scopes, the command refuses instead of restoring it. To restore administrator access, run openclaw dashboard on the Gateway host and open its link in that browser. Alternatively, remove the device with openclaw devices remove <deviceId> and run the same command again while the code is still valid.
Codes are not case-sensitive and the hyphen is optional. They expire after ten minutes and work once.
Options
--yes: approve without asking. The details are still printed.--json: print the result as JSON. Requires--yes.--url <url>,--port <port>,--token <token>,--password <password>,--timeout <ms>: choose the Gateway connection.
Running it over SSH
A plain ssh host openclaw pair ABCD-EFGH has no terminal to answer the question, so nothing is approved. Use ssh -t host openclaw pair ABCD-EFGH.
Requirements
The Gateway must be running, and the CLI connection needs operator.admin. Code pairing does not establish a signed-in user identity, so Gateways with gateway.roles configured refuse it; use the Gateway's identity-aware sign-in method instead.
If the command says no browser is waiting, check that it reaches the same Gateway the browser opened, including any --profile or OPENCLAW_STATE_DIR setting. A browser that confirmed Cancel has withdrawn its request, so its old code can no longer be approved. Cancellation does not revoke a device whose approval already completed; use Devices or openclaw devices remove for that.
