How do I authenticate the dashboard token on localhost vs remote

Localhost (same machine):
Open http://127.0.0.1:18789/.
If it asks for auth, run openclaw dashboard and use the tokenized link (?token=...).
The token is the same value as gateway.auth.token (or OPENCLAW_GATEWAY_TOKEN) and is stored by the UI after first load.
Not on localhost:
Tailscale Serve (recommended): keep bind loopback, run openclaw gateway --tailscale serve, open https://<magicdns>/. If gateway.auth.allowTailscale is true, identity headers satisfy auth (no token).
Tailnet bind: run openclaw gateway --bind tailnet --token "<token>", open http://<tailscale-ip>:18789/, paste token in dashboard settings.
SSH tunnel: ssh -N -L 18789:127.0.0.1:18789 user@host then open http://127.0.0.1:18789/?token=... from openclaw dashboard.
See Dashboard and Web surfaces for bind modes and auth details.