openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

CLI login returns Unauthorized despite successful browser auth #14

New Issue
Closed
opened 2026-02-15 17:15:04 -05:00 by yindo · 3 comments
yindo commented 2026-02-15 17:15:04 -05:00
Owner
Copy Link
Copy Source

Originally created by @levineam on GitHub (Jan 26, 2026).

Environment

  • clawdhub CLI version: 0.3.0
  • OS: macOS
  • Node: v24.9.0

Description

Browser OAuth flow completes successfully ("Logged in. You can close this tab.") but the CLI returns an Unauthorized error.

Steps to Reproduce

  1. Run clawdhub login
  2. Browser opens, authenticate successfully
  3. Browser shows "Completing login… Logged in. You can close this tab."
  4. CLI returns: ✖ Unauthorized / Error: Unauthorized

Expected Behavior

CLI should receive the token and write it to config.

Actual Behavior

Token never reaches CLI. Config file remains without a token:

{
  "registry": "https://clawdhub.com"
}

Troubleshooting Attempted

  • No CLAWDHUB env vars set
  • Cleared config file and retried
  • Tried with explicit flags: clawdhub login --site https://clawdhub.com --registry https://clawdhub.com
  • Tried with DEBUG=* — no additional output

Notes

The browser-side auth succeeds (confirmed by the "Logged in" message), so the issue appears to be in the CLI callback handler receiving or validating the token.

Originally created by @levineam on GitHub (Jan 26, 2026). ## Environment - clawdhub CLI version: 0.3.0 - OS: macOS - Node: v24.9.0 ## Description Browser OAuth flow completes successfully ("Logged in. You can close this tab.") but the CLI returns an Unauthorized error. ## Steps to Reproduce 1. Run `clawdhub login` 2. Browser opens, authenticate successfully 3. Browser shows "Completing login… Logged in. You can close this tab." 4. CLI returns: `✖ Unauthorized` / `Error: Unauthorized` ## Expected Behavior CLI should receive the token and write it to config. ## Actual Behavior Token never reaches CLI. Config file remains without a token: ```json { "registry": "https://clawdhub.com" } ``` ## Troubleshooting Attempted - No CLAWDHUB env vars set - Cleared config file and retried - Tried with explicit flags: `clawdhub login --site https://clawdhub.com --registry https://clawdhub.com` - Tried with `DEBUG=*` — no additional output ## Notes The browser-side auth succeeds (confirmed by the "Logged in" message), so the issue appears to be in the CLI callback handler receiving or validating the token.
yindo closed this issue 2026-02-15 17:15:05 -05:00
yindo commented 2026-02-15 17:15:05 -05:00
Author
Owner
Copy Link
Copy Source

@mordka commented on GitHub (Jan 31, 2026):

Workaround Found

The issue is a domain redirect problem. The CLI defaults to https://clawdhub.com, but the API has moved to https://www.clawhub.ai. The CLI's HTTP client doesn't follow the redirect chain properly:

clawdhub.com → 308 → clawhub.ai → 307 → www.clawhub.ai

Testing manually with curl confirms the token is valid:

curl -s "https://www.clawhub.ai/api/v1/whoami" \
  -H "Authorization: Bearer YOUR_TOKEN"
# Returns: {"user":{"handle":"...","displayName":"..."}}

Workaround: Explicitly specify the registry URL:

# Login with token
clawdhub login --token YOUR_TOKEN --registry https://www.clawhub.ai

This writes the correct registry to your config file and subsequent commands work normally.

Suggested fix: The CLI should either:

  1. Follow HTTP redirects when verifying tokens
  2. Update DEFAULT_REGISTRY in registry.js from https://clawdhub.com to https://www.clawhub.ai
@mordka commented on GitHub (Jan 31, 2026): **Workaround Found** The issue is a domain redirect problem. The CLI defaults to `https://clawdhub.com`, but the API has moved to `https://www.clawhub.ai`. The CLI's HTTP client doesn't follow the redirect chain properly: ``` clawdhub.com → 308 → clawhub.ai → 307 → www.clawhub.ai ``` Testing manually with curl confirms the token is valid: ```bash curl -s "https://www.clawhub.ai/api/v1/whoami" \ -H "Authorization: Bearer YOUR_TOKEN" # Returns: {"user":{"handle":"...","displayName":"..."}} ``` **Workaround:** Explicitly specify the registry URL: ```bash # Login with token clawdhub login --token YOUR_TOKEN --registry https://www.clawhub.ai ``` This writes the correct registry to your config file and subsequent commands work normally. **Suggested fix:** The CLI should either: 1. Follow HTTP redirects when verifying tokens 2. Update `DEFAULT_REGISTRY` in `registry.js` from `https://clawdhub.com` to `https://www.clawhub.ai`
yindo commented 2026-02-15 17:15:05 -05:00
Author
Owner
Copy Link
Copy Source

@nathanatgit commented on GitHub (Jan 31, 2026):

adding --registry https://www.clawhub.ai after --token works

@nathanatgit commented on GitHub (Jan 31, 2026): adding --registry https://www.clawhub.ai after --token works
yindo commented 2026-02-15 17:15:06 -05:00
Author
Owner
Copy Link
Copy Source

@BrennerSpear commented on GitHub (Feb 3, 2026):

Workaround until the fix is merged:

CLAWHUB_REGISTRY=https://www.clawhub.ai clawhub login --token <your-token>

Or set the env var permanently:

export CLAWHUB_REGISTRY=https://www.clawhub.ai

This bypasses the redirect from clawhub.ai → www.clawhub.ai that strips the auth header.

@BrennerSpear commented on GitHub (Feb 3, 2026): **Workaround until the fix is merged:** ```bash CLAWHUB_REGISTRY=https://www.clawhub.ai clawhub login --token <your-token> ``` Or set the env var permanently: ```bash export CLAWHUB_REGISTRY=https://www.clawhub.ai ``` This bypasses the redirect from `clawhub.ai` → `www.clawhub.ai` that strips the auth header.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#14
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?