From cfa49c6e78366b5c32c2b8c8f4eb82c5df3f0da5 Mon Sep 17 00:00:00 2001 From: Ho1yShif Date: Thu, 16 Jul 2026 08:57:57 -0700 Subject: [PATCH] fix(render): issue short-lived WebUI tokens via tokenIssueSecret Map NANOBOT_WEB_TOKEN to channels.websocket.tokenIssueSecret instead of the static token, and remove the static token. The gateway now issues short-lived WebSocket/API tokens rather than accepting a long-lived credential directly at the handshake, matching the public-WebUI login flow and documentation. Users still enter the same NANOBOT_WEB_TOKEN, and websocketRequiresToken remains true. Co-Authored-By: Claude Opus 4.8 (1M context) --- render-config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/render-config.json b/render-config.json index 5fdc3510..f68c0ba9 100644 --- a/render-config.json +++ b/render-config.json @@ -19,7 +19,7 @@ "enabled": true, "host": "0.0.0.0", "port": 8765, - "token": "${NANOBOT_WEB_TOKEN}", + "tokenIssueSecret": "${NANOBOT_WEB_TOKEN}", "websocketRequiresToken": true } },