diff --git a/server/src/__tests__/agents-service-secret-bindings.test.ts b/server/src/__tests__/agents-service-secret-bindings.test.ts
index e85d3688f1..82603cd89f 100644
--- a/server/src/__tests__/agents-service-secret-bindings.test.ts
+++ b/server/src/__tests__/agents-service-secret-bindings.test.ts
@@ -266,6 +266,7 @@ describeEmbeddedPostgres("agent service secret binding sync", () => {
     const companyId = await seedCompany();
     const literalAuthToken = `openclaw-token-${randomUUID()}`;
     const literalPassword = `openclaw-password-${randomUUID()}`;
+    const literalDeviceToken = `openclaw-device-token-${randomUUID()}`;
     const literalPrivateKeyPem = [
       "-----BEGIN PRIVATE KEY-----",
       `openclaw-device-key-${randomUUID()}`,
@@ -281,6 +282,7 @@ describeEmbeddedPostgres("agent service secret binding sync", () => {
         url: "ws://127.0.0.1:18789",
         authToken: literalAuthToken,
         password: literalPassword,
+        deviceToken: literalDeviceToken,
         devicePrivateKeyPem: literalPrivateKeyPem,
       },
       runtimeConfig: {},
@@ -296,8 +298,9 @@ describeEmbeddedPostgres("agent service secret binding sync", () => {
     const serializedConfig = JSON.stringify(persistedConfig);
     expect(serializedConfig).not.toContain(literalAuthToken);
     expect(serializedConfig).not.toContain(literalPassword);
+    expect(serializedConfig).not.toContain(literalDeviceToken);
     expect(serializedConfig).not.toContain(literalPrivateKeyPem);
-    for (const key of ["authToken", "password", "devicePrivateKeyPem"]) {
+    for (const key of ["authToken", "password", "deviceToken", "devicePrivateKeyPem"]) {
       expect(persistedConfig[key]).toMatchObject({
         type: "secret_ref",
         version: "latest",
@@ -316,6 +319,7 @@ describeEmbeddedPostgres("agent service secret binding sync", () => {
     expect(bindings.map((binding) => binding.configPath).sort()).toEqual([
       "authToken",
       "devicePrivateKeyPem",
+      "deviceToken",
       "password",
     ]);
 
@@ -330,6 +334,7 @@ describeEmbeddedPostgres("agent service secret binding sync", () => {
     );
     expect(resolved.config.authToken).toBe(literalAuthToken);
     expect(resolved.config.password).toBe(literalPassword);
+    expect(resolved.config.deviceToken).toBe(literalDeviceToken);
     expect(resolved.config.devicePrivateKeyPem).toBe(literalPrivateKeyPem);
   });
 
diff --git a/server/src/services/secrets.ts b/server/src/services/secrets.ts
index 94bc3341a6..6e06ba4e3b 100644
--- a/server/src/services/secrets.ts
+++ b/server/src/services/secrets.ts
@@ -77,7 +77,7 @@ const COMING_SOON_SECRET_PROVIDERS: ReadonlySet<SecretProvider> = new Set([
 ]);
 const FALLBACK_ADAPTER_SCHEMA_SECRET_FIELDS: Readonly<Record<string, readonly string[]>> = {
   hermes_gateway: ["apiKey"],
-  openclaw_gateway: ["authToken", "token", "password", "devicePrivateKeyPem"],
+  openclaw_gateway: ["authToken", "token", "deviceToken", "password", "devicePrivateKeyPem"],
 };
 const USER_SECRET_DEFINITION_KEY_UNIQUE_CONSTRAINT = "user_secret_definitions_company_key_uq";
 const USER_SECRET_VALUE_UNIQUE_CONSTRAINT = "company_secrets_user_definition_owner_uq";