Setup Guide
OpenClaw Setup Guide: how to setup OpenClaw correctly
This page covers the full OpenClaw setup flow: from install to your first working assistant with secure defaults. Choose managed hosting (zero infra work) or self-managed CLI path.
If you want managed hosting instead, start here. For just the install commands, go to install OpenClaw.
For most people: install OpenClaw, run openclaw onboard --install-daemon, verify with
openclaw gateway status, then open openclaw dashboard and send your first message.
Prerequisites
- Node 22+ on your machine.
- Windows users: use WSL2 for the cleanest path.
- LLM provider credentials (OpenAI/Anthropic/Gemini/etc.) for onboarding.
- Optional: Telegram/Slack tokens if you want channel messaging immediately.
Path A: managed setup
If you want minimal infrastructure work and secure defaults, use OpenClaw Setup managed hosting. You still keep control of your model credentials and bot config, but infra and operations are handled for you.
Path B: self-managed CLI setup
1) Install OpenClaw
macOS/Linux/WSL2:
curl -fsSL https://openclaw.ai/install.sh | bash
Windows PowerShell:
iwr -useb https://openclaw.ai/install.ps1 | iex
2) Run onboarding wizard
openclaw onboard --install-daemon
This configures model auth, workspace defaults, gateway settings, and optional channels.
You can reconfigure later with openclaw configure.
3) Verify gateway health
openclaw gateway status
Expected outcome: running status with no fatal errors.
4) Open Control UI and send first chat
openclaw dashboard
This opens Control UI (typically http://127.0.0.1:18789/). Send a quick message to verify your runtime.
5) Run baseline diagnostics
openclaw doctor openclaw status openclaw dashboard
Security defaults checklist
- Keep dashboard on localhost unless you intentionally expose via trusted tunnel/mesh.
- Treat Control UI as an admin surface (chat + approvals + config).
- Use allowlist access for messaging channels.
- Rotate and protect provider/bot credentials.
- Review security hardening guidance before broad rollout.
Common pitfalls to avoid
- Skipping doctor checks: run
openclaw doctorafter setup and upgrades. - Publicly exposing dashboard: use localhost/Tailscale/SSH tunnel. Never expose your instance to the public internet.
- Mixing install methods carelessly: document whether you used script, npm, or source build.
- Ignoring gateway status: check
openclaw gateway statusbefore debugging channels.
If you hit errors, go to OpenClaw setup troubleshooting.