From a66708a4d7061be7edb89e5c3a8949b81f5d8989 Mon Sep 17 00:00:00 2001 From: "openclaw-docs-sync[bot]" Date: Mon, 4 May 2026 05:52:51 +0000 Subject: [PATCH] chore(sync): mirror docs from openclaw/openclaw@a9d77b3eb09d5e59d551921632775b70dec2c0ba --- .openclaw-sync/source.json | 4 ++-- docs/web/control-ui.md | 10 ++++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json index 2d5459443..76f56e940 100644 --- a/.openclaw-sync/source.json +++ b/.openclaw-sync/source.json @@ -1,5 +1,5 @@ { "repository": "openclaw/openclaw", - "sha": "bc0b54e8448512c5bec26aa7ddff774373884d4b", - "syncedAt": "2026-05-04T05:48:04.564Z" + "sha": "a9d77b3eb09d5e59d551921632775b70dec2c0ba", + "syncedAt": "2026-05-04T05:50:54.867Z" } diff --git a/docs/web/control-ui.md b/docs/web/control-ui.md index c3d033d6b..a896f7dcf 100644 --- a/docs/web/control-ui.md +++ b/docs/web/control-ui.md @@ -384,6 +384,16 @@ When gateway auth is configured, the Control UI avatar endpoint requires the sam If you disable gateway auth (not recommended on shared hosts), the avatar route also becomes unauthenticated, in line with the rest of the gateway. +## Assistant media route auth + +When gateway auth is configured, assistant local-media previews use a two-step route: + +- `GET /__openclaw__/assistant-media?meta=1&source=` requires the normal Control UI operator auth. The browser sends the gateway token as a bearer header when checking availability. +- Successful metadata responses include a short-lived `mediaTicket` scoped to that exact source path. +- Browser-rendered image, audio, video, and document URLs use `mediaTicket=` instead of the active gateway token or password. The ticket expires quickly and cannot authorize a different source. + +This keeps normal media rendering compatible with browser-native media elements without putting reusable gateway credentials in visible media URLs. + ## Building the UI The Gateway serves static files from `dist/control-ui`. Build them with: