🦞ClawTips
← Back to library

Portainer/LAN 场景下“WebUI 可用但 CLI unauthorized”排障剧本

用于“容器部署后局域网能打开 WebUI，但 OpenClaw CLI 被拒绝”的场景：按网络暴露、认证配置、反向代理与 token 路径逐层定位。

REDDITDiscovered 2026-02-13Author u/alperson1977
Prerequisites
  • OpenClaw is running in Docker/Portainer with editable compose stack.
  • You can inspect gateway logs and environment variables for auth settings.
  • LAN client and server can test direct host:port connectivity.
Steps
  1. Confirm WebUI and CLI are targeting the same gateway endpoint and protocol (http/https/ws).
  2. Verify token/pairing credentials in CLI config match server runtime config exactly.
  3. Check container port mappings and reverse-proxy headers for websocket/auth passthrough issues.
  4. Run CLI auth tests from both host machine and LAN client to isolate network-vs-config root cause.
  5. After fix, document a known-good compose + gateway auth template to prevent repeat incidents.
Commands
openclaw gateway status
openclaw gateway restart
openclaw help
docker compose ps
docker compose logs --tail=200
Verify

From another LAN device, both WebUI and CLI complete authenticated operations without unauthorized errors.

Caveats
  • Source is a help thread (not a finalized postmortem); exact root cause may vary per stack（需验证）.
  • Avoid exposing management ports directly to WAN while troubleshooting.
Source attribution

This tip is aggregated from community/public sources and preserved with attribution.

Open original source ↗
Visit original post