docs: refresh exposed bind auth mirrors

This commit is contained in:
Peter Steinberger
2026-04-04 21:01:34 +01:00
parent 1ae356c40c
commit 7678917c49
3 changed files with 10 additions and 4 deletions

View File

@@ -110,7 +110,7 @@ read_when:
**Notes:**
- Non-loopback binds (`--bind lan`) require `OPENCLAW_GATEWAY_TOKEN` for security.
- Non-loopback binds (`--bind lan`) require a valid gateway auth path. This Fly.io example uses `OPENCLAW_GATEWAY_TOKEN`, but `gateway.auth.password` or a correctly configured non-loopback `trusted-proxy` deployment also satisfy the requirement.
- Treat these tokens like passwords.
- **Prefer env vars over config file** for all API keys and tokens. This keeps secrets out of `openclaw.json` where they could be accidentally exposed or logged.