Auth-heavy workflows
Sign in once from the dashboard viewer, complete MFA or CAPTCHA yourself, then let the agent continue inside the same browser profile.
OpenClaw with browser
Give your OpenClaw instance a browser it can keep.
Hosted Browser adds a persistent Chromium sidecar to your managed OpenClaw instance. The agent can drive it through local CDP, and you can open the same browser from the dashboard when a site needs login, MFA, CAPTCHA, or a human decision.
Why it matters
The hard part of browser agents is not opening a page. It is staying useful after login.
Long-running context
The browser belongs to the instance, so your logged-in session and downloads are not tied to a disposable headless launch.
Human takeover
When the agent reaches a step that needs judgment, the user can open the browser directly and continue without switching machines.
How it works
One browser session shared through two controlled paths.
01
Enable Hosted Browser
Turn it on from Addons. OpenClaw Setup deploys the browser sidecar with the instance runtime.
02
Authenticate once
Open the browser from your account and sign into the services your workflow needs.
03
Let the agent work
OpenClaw uses its built-in browser profile through local CDP, reusing the same browser state.
04
Take over when needed
Open the dashboard browser again for MFA, CAPTCHA, downloads, uploads, or manual review.
Choose the right browser path
Hosted Browser, Chrome relay, and web fetch solve different jobs.
| Need | Use Hosted Browser | Use Chrome Extension relay | Use web search/fetch |
|---|---|---|---|
| Agent needs a persistent cloud-side browser | Best fit | Not the goal | No interactive session |
| User must help with login or MFA | Best fit | Works if the local tab is attached | Not enough |
| Agent must use a tab already open on your laptop | Possible, but indirect | Best fit | Not enough |
| Fast read-only retrieval | Overkill | Overkill | Best fit |
Security model
Useful browser access without making browser control public.
Hosted Browser is designed around a narrow boundary: OpenClaw gets CDP locally inside the pod, and the user gets a dashboard-authenticated visual session. The public surface is the OpenClaw Setup auth proxy, not a raw VNC or CDP port.
- CDP binds on pod loopback for the OpenClaw runtime.
- KasmVNC is reached through the backend auth proxy.
- The account owner can open the browser from the dashboard.
- The browser profile can be reset from the Addons tab.
Run OpenClaw with a browser that belongs to the instance.
Start with managed OpenClaw hosting, enable Hosted Browser from Addons, and give your agent a persistent browser session you can still see and control.