OpenClaw “origin not allowed” fix

Problem statement: Control UI loads, but instead of chat you see origin not allowed (open the Control UI from the gateway host or allow it in gateway.controlUi.allowedOrigins) This usually appears when deploying through FRP/Nginx/Caddy or public IP forwarding.

Actionable fix sequence

1. Choose one canonical UI URL (for example: https://agent.example.com).
2. Add exact origin allowlist in ~/.openclaw/openclaw.json:

   {
     "gateway": {
       "controlUi": {
         "allowedOrigins": ["https://agent.example.com"]
       }
     }
   }

3. Restart gateway: openclaw gateway restart.
4. Proxy hygiene: make sure your reverse proxy forwards Host and X-Forwarded-Proto consistently.
5. Retest in incognito to avoid stale browser cache/token state.

What usually causes repeated failures

• Mixing IP and domain access (e.g., open by IP once, domain next).
• Allowing the wrong scheme (http vs https mismatch).
• Changing forwarded host in FRP/Nginx while keeping old origin list.
• Using wildcard origins in one layer while another layer enforces strict host checks.

Fix once. Stop recurring origin-policy failures.

If this keeps coming back, you can move your existing setup to managed OpenClaw cloud hosting instead of rebuilding the same stack. Import your current instance, keep your context, and move onto a runtime with lower ops overhead.

• Import flow in ~1 minute
• Keep your current instance context
• Run with managed security and reliability defaults

If you would rather compare options first, review OpenClaw cloud hosting or see the best OpenClaw hosting options before deciding.

Import your current OpenClaw instance in 1 click Keep self-hosted: apply fix checklist

FAQ

Can I keep both IP and domain allowed?

Yes, but only if both are intentional. Keep the list explicit and minimal.

Why did it work locally but fail in cloud?

Cloud and proxy setups introduce browser-origin differences that local loopback deployments don’t have.

Sources

• OpenClaw issue #29809 (updated 2026-03-01)
• OpenClaw docs (gateway/control UI configuration reference)