https://blog.margrop.net/en/tag/authorization/ Recent content in Authorization on Margrop Blog Hugo en-US Fri, 10 Jul 2026 08:00:00 +0800 https://blog.margrop.net/en/post/openclaw-missing-operator-write-scope/ Fri, 10 Jul 2026 08:00:00 +0800 https://blog.margrop.net/en/post/openclaw-missing-operator-write-scope/ <p>This incident looked like a model-provider outage at first. OpenClaw had just received three NewAPI-backed fallback models, but gateway-based model calls started failing with a provider authentication error. After peeling back the outer message, the real error was much more specific:</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>missing scope: operator.write </span></span></code></pre></div><p>That string changed the direction of the investigation. The provider key was not the root problem. The NewAPI endpoint was not the root problem. The model names were not the root problem either. The failure lived inside OpenClaw&rsquo;s gateway authorization path: when a model override was used, the gateway call switched into a backend/gateway-client mode, but did not force the request to use the already paired stored device identity. The device had <code>operator.write</code>; the request simply did not carry the identity that could prove it.</p> <p>The shortest version is this: <strong>the badge existed, but this entrance did not scan it.</strong></p> <p><img src="https://blog.margrop.net/post-images/openclaw-missing-operator-write-scope/cover.png" alt="AI-generated cover showing a gateway protected by two authorization locks"></p>