From 5a6179aa8bc5abf92a334eb844198055ef653aad Mon Sep 17 00:00:00 2001
From: Marcel Hild <hild@b4mad.net>
Date: Sun, 8 Mar 2026 13:19:44 +0100
Subject: [PATCH] fix: exclude token from device signing payload in password
 auth mode

When authMode is 'password', the auth token is null/undefined, but was
being included in the device signing payload. This caused a signature
mismatch on the gateway side, preventing password-mode auth from working.
---
 src/lib/gateway.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/gateway.ts b/src/lib/gateway.ts
index 2c1a871..b2256c1 100644
--- a/src/lib/gateway.ts
+++ b/src/lib/gateway.ts
@@ -137,7 +137,7 @@ export class GatewayClient {
         role,
         scopes,
         signedAtMs,
-        token: this.authToken || null,
+        token: this.authMode === 'password' ? null : (this.authToken || null),
         nonce,
       });
       const signature = await signPayload(this.deviceIdentity.keyPair.privateKey, payload);