Windows Companion reports refresh_token_reused after reauthentication

Troubleshooting
, , , ,
1

Adapted community discussion: Paraphrased and condensed from an anonymized public OpenClaw Discord support conversation from August 2026. Technical guidance was reviewed for OpenClaw 2026.9.3.

Every session in Windows Companion fails with an OpenAI OAuth refresh error saying the refresh token was already used. I stopped the managed WSL Gateway, forced a fresh device login, and model status looks healthy, but the first real request still fails. I also see the Codex plugin fail during registration. How can I repair this without losing channels, skills, memory, or workspace data?

2

The false-green status and plugin registration error indicate a package or credential-lifecycle failure, not evidence that the workspace is corrupt. Since Companion owns the WSL Gateway, do not run global package installs or gateway install --force inside that managed environment. Exit Companion and create a verified OpenClaw backup before changing authentication or versions.

3

Is there a Companion-supported way to roll its app-owned Gateway back while preserving the managed WSL environment?

4

The installed Companion version may expose different recovery controls. Preserve Companion settings and a verified Gateway backup, then avoid unregistering the distro, editing its virtual disk, or manually replacing packages. Use the update and recovery controls presented by the installed Companion version.

5

Why did the failure appear days after the update?

6

A refresh-token problem can remain hidden until an access token expires or a refresh is forced. A plugin mismatch may also remain latent until restart or first use. If the Gateway still runs, use a separately authenticated provider in a fresh session as a temporary route. A model fallback cannot help if the plugin crash prevents the Gateway from starting at all.

7

For OpenClaw 2026.9.3, first update Companion and its managed Gateway through the supported app flow, then run the app-supported health and authentication checks. Reauthenticate once after versions are aligned. Preserve the backup until a live model request succeeds.