Use dmPolicy: open to disable pairing for headless/Docker

start.sh

@@ -157,6 +157,10 @@ if [ -n "$SPACE_HOST" ]; then
   CONFIG_JSON=$(echo "$CONFIG_JSON" | jq ".gateway.controlUi.allowedOrigins = [\"https://${SPACE_HOST}\"]")
 fi
 
+# Disable pairing for headless/Docker — allow open connections
+# Note: This allows any client with the gateway token. Only use in trusted networks.
+CONFIG_JSON=$(echo "$CONFIG_JSON" | jq ".channels.control_ui = {\"dmPolicy\": \"open\", \"allowFrom\": [\"*\"]}")
+
 # Telegram (supports multiple user IDs, comma-separated)
 if [ -n "$TELEGRAM_BOT_TOKEN" ]; then
   CONFIG_JSON=$(echo "$CONFIG_JSON" | jq '.plugins.entries.telegram = {"enabled": true}')
@@ -241,8 +245,7 @@ echo "🚀 Launching OpenClaw gateway on port 7860..."
 echo ""
 # Set model via environment for the gateway
 export LLM_MODEL="$LLM_MODEL"
-# Disable pairing for Docker/headless environments via CLI flag
-openclaw gateway run --port 7860 --bind lan --verbose --no-pairing 2>&1 | tee -a /home/node/.openclaw/gateway.log &
+openclaw gateway run --port 7860 --bind lan --verbose 2>&1 | tee -a /home/node/.openclaw/gateway.log &
 GATEWAY_PID=$!
 
 # Wait a moment for startup errors