OpenClaw Main Binds MCP Refresh Tokens to Their Issuer

OpenClaw has merged an important MCP OAuth correction into main: a stored refresh token is now usable only with the authorization-server issuer that granted it.

That sounds like ordinary metadata hygiene. It is actually a credential boundary. A refresh token is authority, and server discovery must not be allowed to redirect that authority to a different issuer after the token is stored.

Availability: these changes are merged source, not proof that a current stable package contains them. Track the containing release before treating an installation as protected.

The old record did not bind enough identity

PR #112032 describes the previous MCP OAuth record as token-centric. On refresh, OpenClaw could rediscover current authorization-server metadata and submit a stored refresh token without first proving that the discovered issuer matched the server that originally issued it.

The repaired record persists normalized issuer identity alongside the OAuth grant. Refresh is allowed only when current metadata resolves to the same issuer. Missing issuer data, an issuer mismatch, or an inconsistent authorization-server URL now fails closed before token submission.

The change also keeps public-client and private-client handling separate. Client credentials may be resolved where the registered client type requires them, but that does not weaken issuer comparison.

Interpretation: endpoint discovery is routing information. It is not permission to move an existing credential between authorities.

Older token-only rows are a migration decision

The safe compatibility choice is deliberately conservative. A legacy record containing a refresh token but no trustworthy issuer cannot be silently upgraded by copying whatever discovery returns today; doing so would bless the very reassignment the fix is meant to prevent.

Operators should therefore expect some existing MCP connections to require one clean authorization after installing a containing build. That is safer than making a durable identity claim from current network metadata alone.

Do not work around the failure by editing issuer fields into the database or copying refresh tokens between profiles. Reauthorize against the intended server and let the OAuth owner persist a complete record.

Login sessions now have one identity owner

PR #122115 consolidates OAuth identity, authorization-session persistence and resume behavior. The practical gain is that callback, device-code polling, restart recovery and refresh no longer need separate interpretations of which server, client and requester own the login.

PR #122129 repairs a regression in that sequence: beginning or resuming authorization must not discard an already-authorized session before replacement succeeds. An interrupted login should leave the valid prior grant usable rather than turning authentication into an all-or-nothing destructive rewrite.

These follow-ups are useful context, but they do not dilute the security rule: resumed sessions and replacement grants still need exact issuer identity.

Operator rollout

Use a non-production MCP server and synthetic account:

1. inventory MCP OAuth connections and identify any that predate issuer-bound storage;
2. back up the relevant OpenClaw state using a supported SQLite snapshot or OpenClaw backup command—never a raw copy of a live WAL database;
3. deploy a containing build to staging;
4. confirm an existing issuer-bound grant refreshes without an interactive login;
5. present metadata with a different issuer and require refresh to fail before any token is sent;
6. exercise an old token-only row and accept reauthorization rather than fabricating issuer metadata;
7. interrupt a replacement login and verify the previously authorized session remains available; and
8. complete reauthorization, restart the Gateway and confirm the exact issuer and requester identity survive.

Keep OAuth tokens, client secrets and callback query parameters out of logs and screenshots. Test failure classification with synthetic values rather than printing stored credentials.

Bottom line

Refresh tokens must stay with the authority that issued them. OpenClaw’s new MCP record enforces that rule, and the one-time cost may be reauthorizing legacy token-only sessions. That is the correct trade: explicit login is cheaper than silently presenting a durable credential to the wrong server.