Rate-limit the optional agent bearer path after user auth resolution so mixed user/agent routes no longer leave an unthrottled PBKDF2 path. Stop logging token prefixes on agent auth failures and require a locally supplied token for backend/.env.test instead of committing one. Update tests and docs to cover agent bearer fallback, configurable webhook signature headers, and the operator-facing security settings added by the hardening work. Co-Authored-By: Claude <noreply@anthropic.com>
Mission Control docs
This folder is the documentation home for OpenClaw Mission Control.
Start here
- Getting started
- Development
- Testing
- Deployment
- Release checklist
- Operations
- Troubleshooting
- Gateway agent provisioning and check-in troubleshooting
- Gateway WebSocket protocol
- OpenClaw baseline configuration