Problem:
- models.providers.ollama.models: Invalid input: expected array, received undefined
- models.providers.ollama: Unrecognized keys: "enabled", "timeout"
- models: Unrecognized keys: "default", "allowlist", "fallbackChain"
- agents.defaults.model: Unrecognized keys: "fallback", "fast"
- agents.defaults: Unrecognized keys: "agentDir", "tools", "memory"
- agents.list.5.tools.elevated.allowFrom: Invalid input: expected record, received array```
#need help in agent and models
1 messages · Page 1 of 1 (latest)
"models": {
"default": "ollama/llama3.3",
"allowlist": [
"ollama/llama3.3",
"ollama/mistral",
"ollama/codellama",
"ollama/llama3.1",
"ollama/qwen2.5"
],
"fallbackChain": [
"ollama/llama3.3",
"ollama/mistral"
],
"providers": {
"ollama": {
"enabled": true,
"baseUrl": "http://127.0.0.1:11434/v1",
"timeout": 300000
}
}
},
Those validation errors are what you get when you paste an old/other-version config schema into a newer OpenClaw. New OpenClaw is very strict: unknown keys = gateway won’t start.
If you paste openclaw --version + the relevant parts of your ~/.openclaw/openclaw.json (just the models, agents.defaults, and the agent entry that has tools.elevated), I can tell you exactly what to change. In the meantime, here’s how to fix each class of error.
1) models: Unrecognized keys: "default", "allowlist", "fallbackChain"
Those keys don’t exist anymore. Model selection moved under agents.defaults.model:
{
agents: {
defaults: {
model: {
primary: "ollama/gpt-oss:20b",
fallbacks: ["ollama/llama3.3"],
},
// optional allowlist/catalog (+ aliases)
models: {
"ollama/gpt-oss:20b": { alias: "oss" },
"ollama/llama3.3": { alias: "llama" },
},
},
},
}
Docs: https://docs.openclaw.ai/concepts/models and https://docs.openclaw.ai/gateway/configuration
2) agents.defaults.model: Unrecognized keys: "fallback", "fast"
Use primary + fallbacks (array) now (see snippet above).
3) models.providers.ollama: Unrecognized keys: "enabled", "timeout"
models.providers.ollama doesn’t take enabled/timeout. For Ollama you usually want one of these:
Option A (simplest): implicit discovery (recommended)
Don’t define models.providers.ollama at all. Just set an API key (any value) and pick an ollama/... model:
export OLLAMA_API_KEY="ollama-local"
{
agents: { defaults: { model: { primary: "ollama/gpt-oss:20b" } } },
}
Option B: explicit provider (manual models)
If you define models.providers.ollama, in your version it looks like models must be an array, so include it:
{
models: {
providers: {
ollama: {
baseUrl: "http://127.0.0.1:11434/v1",
apiKey: "ollama-local",
api: "openai-completions",
models: [
{
id: "gpt-oss:20b",
name: "GPT-OSS 20B",
reasoning: false,
input: ["text"],
cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
contextWindow: 8192,
maxTokens: 8192 * 10,
},
],
},
},
},
}
Docs: https://docs.openclaw.ai/providers/ollama
4) agents.defaults: Unrecognized keys: "agentDir", "tools", "memory"
Those keys don’t live under agents.defaults anymore.
- Workspace is
agents.defaults.workspace(notagentDir). - Tool config is top-level under
tools: { ... }(and/or per-agent underagents.list[]...depending what you’re doing).
- “memory” is typically a tools allow/profile thing now (plus
compaction.memoryFlushif you’re trying to persist notes).
5) agents.list.5.tools.elevated.allowFrom: expected record, received array
allowFrom must be an object keyed by provider, not a raw array. Example:
{
tools: {
elevated: {
enabled: true,
allowFrom: {
discord: ["user:123456789012345678"], // or your username/id forms
},
},
},
}
Docs: https://docs.openclaw.ai/tools/elevated
If you reply with:
openclaw --version- the
modelsblock you currently have - your
agentsblock (or justagents.defaults+ the specificagents.list[5]entry)
…I’ll rewrite it into a schema-valid config for your exact setup (Ollama + your agent/tool policies).
Yep — that block is the old schema. In current OpenClaw:
models.default / allowlist / fallbackChaindo not existmodels.providers.ollama.enabled / timeoutdo not exist- “default model + fallbacks + allowlist” now live under
agents.defaults models: { providers: ... }is only for custom provider registry (and if you defineollamathere, you must also define amodels: [...]array)
Here’s how to translate your snippet.
A) Recommended: Ollama auto-discovery (least config)
Remove the entire models: { providers: { ollama: ... } } block from your config, and set:
export OLLAMA_API_KEY="ollama-local"
Then in config, set the default + fallbacks + allowlist like this:
{
agents: {
defaults: {
model: {
primary: "ollama/llama3.3",
fallbacks: ["ollama/mistral"],
},
// this is the allowlist/catalog used by /model
models: {
"ollama/llama3.3": { alias: "llama" },
"ollama/mistral": { alias: "mistral" },
"ollama/codellama": {},
"ollama/llama3.1": {},
"ollama/qwen2.5": {},
},
},
},
}
Auto-discovery will query your local Ollama at http://127.0.0.1:11434 and populate what’s actually tool-capable.
Docs: https://docs.openclaw.ai/providers/ollama
B) If you must keep an explicit baseUrl
Then you can keep models.providers.ollama, but you must delete enabled + timeout and add a models: [...] array:
{
models: {
providers: {
ollama: {
baseUrl: "http://127.0.0.1:11434/v1",
apiKey: "ollama-local",
api: "openai-completions",
models: [
{
id: "llama3.3",
name: "Llama 3.3",
reasoning: false,
input: ["text"],
cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
contextWindow: 8192,
maxTokens: 8192 * 10,
},
{
id: "mistral",
name: "Mistral",
reasoning: false,
input: ["text"],
cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
contextWindow: 8192,
maxTokens: 8192 * 10,
},
],
},
},
},
agents: {
defaults: {
model: { primary: "ollama/llama3.3", fallbacks: ["ollama/mistral"] },
models: {
"ollama/llama3.3": {},
"ollama/mistral": {},
},
},
},
}
If you paste your full openclaw --version and whether you want auto-discovery (A) or manual list (B), I’ll tailor the exact config (and include the right Ollama model IDs you actually have installed).
openclaw gateway status
🦞 OpenClaw 2026.2.17 (4134875) — Your messages, your servers, your control.
│
gateway connect failed: Error: unauthorized: device token mismatch (rotate/reissue device token)
â—‡
Service: systemd (enabled)
File logs: /tmp/openclaw/openclaw-2026-02-19.log
Command: /usr/bin/node /usr/lib/node_modules/openclaw/dist/index.js gateway --port 18789
Service file: ~/.config/systemd/user/openclaw-gateway.service
Service env: OPENCLAW_GATEWAY_PORT=18789
Config (cli): ~/.openclaw/openclaw.json
Config (service): ~/.openclaw/openclaw.json
Gateway: bind=loopback (127.0.0.1), port=18789 (service args)
Probe target: ws://127.0.0.1:18789
Dashboard: http://127.0.0.1:18789/
Probe note: Loopback-only gateway; only local clients can connect.
Runtime: running (pid 871161, state active, sub running, last exit 0, reason 0)
Warm-up: launch agents can take a few seconds. Try again shortly.
RPC probe: failed
RPC target: ws://127.0.0.1:18789
gateway closed (1008): unauthorized: device token mismatch (rotate/reissue device token)
Gateway target: ws://127.0.0.1:18789
Source: cli --url
Config: /root/.openclaw/openclaw.json
Port 18789 is already in use.
- pid 871161 root: openclaw-gateway (127.0.0.1:18789)
- Gateway already running locally. Stop it (openclaw gateway stop) or use a different port.
Listening: 127.0.0.1:18789
Troubles: run openclaw status
"gateway": {
"port": 18789,
"mode": "local",
"bind": "loopback",
"auth": {
"mode": "token",
"token": "e627d9650c7154c96f0f72a61f74fa75b3018ae6ec432f1f"
},
"tailscale": {
"mode": "off",
"resetOnExit": false
},
"nodes": {
"denyCommands": [
"camera.snap",
"camera.clip",
"screen.record",
"calendar.add",
"contacts.add",
"reminders.add"
]
}
},
That error is not your gateway.auth.token — it’s the cached device token the CLI/UI stores after pairing.
Also important: your output says Source: cli --url and the docs rule is:
if you set
--url, the CLI does not fall back to config/env creds — you must pass--tokenor--password.
So right now you’re likely probing with a stale device token and no shared gateway token fallback, which is why it tells you “rotate/reissue device token”.
Fix (usually 30 seconds)
1) Re-run the probe with an explicit gateway token
(Redact the token if you paste output back here.)
openclaw gateway status \
--url ws://127.0.0.1:18789 \
--token "e627d9650c7154c96f0f72a61f74fa75b3018ae6ec432f1f"
If the CLI has a stale device token cached, having the shared gateway token available lets it clear/re-fallback and reconnect.
2) If it still says “device token mismatch”: clear the cached device token file
The device token cache lives here:
- default:
~/.openclaw/identity/device-auth.json - in your case (running as root per the status output):
/root/.openclaw/identity/device-auth.json
Safer than deleting: move it aside:
mv /root/.openclaw/identity/device-auth.json /root/.openclaw/identity/device-auth.json.bak