How to Set Up OpenClaw on a VPS

OpenClaw can run its gateway as a user service on a Linux VPS, but the gateway controls tools, credentials, and connected channels. Install it under a dedicated administrator account, keep the dashboard private, and verify the daemon before adding integrations.

Use the official OpenClaw installation guide, Node runtime requirements, getting-started workflow, and gateway security guidance as the authority for this procedure.

Prepare the VPS

Create a normal sudo-capable administrator account, configure key-based SSH, and keep provider-console access available. Allow SSH before enabling a host firewall:

“`bash title="Allow SSH through UFW and enable it" sudo ufw allow OpenSSH sudo ufw enable sudo ufw status verbose

Do not open the OpenClaw gateway port to the public internet. The dashboard and gateway are administrative surfaces and should stay bound to loopback unless the official security model for another transport is deliberately implemented.

## Install the supported Node runtime

Read OpenClaw's Node requirements before choosing a runtime. Use a maintained Node installation method for the administrator account, then verify that `node` and `npm` resolve without `sudo`:

```bash title="Verify the active Node and npm executables"
node --version
npm --version
command -v node
command -v npm

If the versions do not satisfy the OpenClaw requirement page, stop and correct Node before installing OpenClaw. Avoid mixing a system package, a user version manager, and root-owned global npm packages in the same account.

Install OpenClaw

Install the package with npm under the prepared administrator account:

“`bash title="Install the latest OpenClaw package globally" npm install –global openclaw@latest openclaw –version

The package name and install command should be rechecked against the official install page before execution. Do not run copied installer scripts from mirrors or unverified tutorials.

Start the onboarding workflow and ask it to install the daemon:

```bash title="Onboard OpenClaw and install its daemon"
openclaw onboard --install-daemon

Complete authentication only in the intended terminal and browser session. Store provider tokens in the credential mechanism recommended by OpenClaw, never in shell history, article notes, or shared screenshots.

Define a least-privilege operating model

Write down what the OpenClaw instance may read, what it may change, which external accounts it may contact, and who can approve sensitive actions. Treat that list as the boundary for credentials, plugins, skills, network access, and workspace files.

Use separate service credentials where an integration supports them instead of reusing a personal administrator token. Start with read-only or narrowly scoped permissions, verify the intended task, and grant additional access only when a specific workflow requires it.

Keep private keys, password-manager exports, infrastructure credentials, and unrelated project repositories outside the OpenClaw workspace. File permissions are not a complete boundary when the gateway can run tools as the same operating-system user, so the account itself should not own data the agent never needs.

Plan how to disable the gateway and revoke credentials if an integration behaves unexpectedly. The response record should name the service owner, token-revocation locations, log locations, and the checks required before access is restored.

Review outbound network requirements as well as inbound exposure. A loopback-only dashboard reduces direct browser exposure, but connected providers and tools still make outbound requests; restrict destinations where the platform and workflow permit it, and investigate unexplained connections.

Verify the gateway

Check the daemon with OpenClaw's own command:

“`bash title="Show the OpenClaw gateway status" openclaw gateway status

The expected result is a running gateway owned by the administrator account. On Linux, onboarding installs a systemd user service; inspect it through the documented OpenClaw status and log commands rather than inventing a root system service with different paths.

Open the dashboard with:

```bash title="Open the OpenClaw dashboard"
openclaw dashboard

Use an SSH tunnel or another private transport when the browser is not on the VPS. For an SSH tunnel, define OPENCLAW_HOST as the real VPS hostname and OPENCLAW_USER as the prepared SSH account before running:

“`bash title="Tunnel the OpenClaw dashboard over SSH" ssh -L 18789:127.0.0.1:18789 "${OPENCLAWUSER}@${OPENCLAWHOST}"

Keep the SSH session open while using the local dashboard address. Do not replace the loopback bind with `0.0.0.0` merely to make the page easier to reach.

## Add credentials and channels carefully

Connect one provider or channel at a time. Grant only the scopes required for the intended workflow, verify the identity of every connected account, and test with a non-sensitive action before enabling tools that can modify external systems.

Review the gateway security guide after each integration. Rotate any token that appears in terminal sharing, logs, browser captures, chat messages, or backups, and remove unused credentials promptly.

Treat plugins and skills as executable code. Install only reviewed packages from trusted sources, record their origin, and test them with the least privilege available.

## Update OpenClaw

Read the [official update instructions](https://docs.openclaw.ai/install/updating). The automatic pre-update configuration copy is not a full recovery point, so create and verify the documented portable backup before a significant update:

```bash title="Back up update diagnose and restart OpenClaw"
install -d -m 0700 "${HOME}/Backups/openclaw"
openclaw backup create --output "${HOME}/Backups/openclaw" --verify
openclaw update
openclaw doctor
openclaw gateway restart
openclaw health

The verified archive can contain credentials, authentication profiles, and channel state. Keep its local directory owner-only, copy it to storage that encrypts data at rest through an authenticated channel, and keep recovery keys separate from the archive. If byte-for-byte recovery of volatile artifacts is required, stop the gateway and take a filesystem, volume, or VM snapshot before updating.

After an update, reopen the dashboard and test one harmless action for each important integration. If verification fails, follow the official rollback sequence: try a code-only rollback first and restore pre-update state only when the older code cannot use migrated state. Restoring state discards changes made after the backup, so do not delete or overwrite the failed state before diagnosis.

Migrate an existing installation

Follow the official migration guide. Run openclaw status on the source host to identify the active state-directory path, including any custom profile or OPENCLAW_STATE_DIR, then stop the source gateway so files do not change during transfer.

Migrate the complete active state directory and the workspace; copying only openclaw.json or selected credential files is not sufficient because sessions, authentication profiles, channel state, skills, prompts, and memory live elsewhere. Archive every active profile when more than one is used. Store the migration archive encrypted, transfer it through an authenticated encrypted channel, and never place the state directory, workspace, or archive in shared storage or a public repository.

On the destination, confirm that hidden files were included and that the complete state directory and workspace belong to the user running the gateway. Run openclaw doctor, restart the gateway, verify status, sessions, workspace files, and channel connections, and rotate high-value credentials if the archive or transfer may have been exposed. Keep the source host intact until these checks pass, and return client access to it if destination verification fails.

Troubleshoot without widening exposure

If onboarding fails, verify Node, npm ownership, DNS, and outbound connectivity before reinstalling. If the daemon fails, use openclaw gateway status and the official diagnostic commands to find the first error.

Do not solve a dashboard connection problem by publishing the gateway port. Check the SSH tunnel, loopback listener, daemon owner, and local browser address first.

Next steps

Record the OpenClaw account owner, Node installation method, credential owners, installed integrations, and update procedure.