Quick answer: the install steps changed in OpenClaw 2.0
If you are following an OpenClaw walkthrough written before September 2026 — including the earlier version of this page — its install steps are out of date. OpenClaw 2.0 shipped as release v2026.8.1 on 31 August 2026 (UTC) and rewrote the parts most guides describe: onboarding, the web interface, where sessions are stored, and how the agent finds a model.
The current path: run the official installer script from openclaw.ai or install the npm package, let onboarding scan your machine for AI access you already have, connect one messaging channel, then configure the rest by talking to the agent. The environment-variable editing older guides walk you through is no longer the front door.
Two things this guide will not soften. OpenClaw is MIT-licensed and free; the model usage behind it is not. And it is not safe out of the box — sandboxing ships off and the secret store is unencrypted. Security is part of setup here, not an appendix.
What OpenClaw is in 2026
OpenClaw is a self-hosted gateway connecting chat apps you already use to AI agents running on your own hardware. You message it on Telegram, Slack, WhatsApp or a browser chat window, and it answers, remembers, calls tools and does work. There is no hosted login page: nothing exists until you install the gateway somewhere.
Everything routes through that one daemon, which holds your channel connections, owns agent sessions, and binds by default to loopback on 127.0.0.1:18789. The browser Control UI, the openclaw CLI, the macOS menu bar app and paired device nodes are all clients of it.
Peter Steinberger created it, and stewardship moved to the OpenClaw Foundation after he joined OpenAI in February 2026. The code is MIT licensed, and the repository showed 388,519 stars on 1 September 2026 — a measure of attention, not of production deployments.
What 2.0 changed that breaks older guides
Onboarding was rebuilt around discovery. Setup scans for AI access you already have — a Codex, ChatGPT or Claude login, a stored API key, a local Ollama or LM Studio model — and verifies the chosen model answers before saving. Guides telling you to hand-write provider credentials into environment variables describe the previous design.
Storage moved, and this is the one that bites. Sessions and transcripts now live in SQLite rather than loose transcript files, sessions created after the migration will not appear in older releases, and the release notes tell you to take a verified backup before upgrading.
The rest: the Control UI was rebuilt around conversations, pairing gained Full and Limited access modes, LAN connections got certificate pinning, and shared cloud sessions let more than one person join a session — the change that makes OpenClaw usable by a small team.
Before you install: requirements and two decisions
OpenClaw requires Node 22.22.3+, 24.15+, or 25.9+, with Node 26 recommended, and runs on macOS, Linux and Windows. The installer provisions Node if it is missing, but an old Node already on PATH is the most common cause of a failed install.
Decide where it runs
A laptop is fine for evaluation and a bad host for anything answering messages at 3am, because the agent is alive only while the machine is. For always-on use, run it on a small VPS or a spare Mac mini with the gateway installed as a managed service.
One hard constraint: a single gateway per host owns the WhatsApp session exclusively, so a personal instance and a business instance each need their own host or OS user. A gateway is one trust boundary, for one operator or one mutually trusting team.
Decide how it gets model access
OpenClaw is model-agnostic, with dozens of providers documented: Anthropic, OpenAI, Google, Mistral and xAI, cloud platforms like Amazon Bedrock and Azure, inference services including Groq and Together, and local runners such as Ollama, LM Studio, llama.cpp and vLLM. Three routes: reuse a subscription login onboarding detects, supply your own API key, or point it at your own hardware. Most businesses take the API key route — see our bring your own key (BYOK) guide for the billing mechanics.
How to install OpenClaw
Four routes: the installer script, a package manager, the desktop apps, or a server deployment. Commands below come from the official install documentation as of September 2026 — check docs.openclaw.ai/install before running them, because this project ships fast.
The installer script, and the npm alternative
On macOS, Linux or WSL2 the documented one-liner is curl -fsSL https://openclaw.ai/install.sh | bash. On Windows, PowerShell users run iwr -useb https://openclaw.ai/install.ps1 | iex. The script detects your OS, provisions Node if needed and drops you into onboarding; append --no-onboard on bash or -NoOnboard on PowerShell to skip that. Piping a remote script straight into a shell is a habit worth breaking — download it, read it, then run it.
The npm route is npm install -g openclaw@latest --allow-scripts=openclaw followed by openclaw onboard --install-daemon. Equivalents exist for pnpm and Bun, and you can build from source if you are contributing or chasing an unreleased fix.
Desktop apps and servers
Signed desktop apps exist for both platforms: a .dmg from the OpenClaw GitHub releases page, and an x64 or ARM64 installer from the separate Windows hub releases repository. Either can provision a local gateway or connect to a remote one, which is how you get a friendly interface on your laptop while the agent runs on a server. For servers, the docs cover Docker, Kubernetes, Render, Cloudflare and VPS providers; flags change between releases, so follow those rather than a container recipe from any blog post.
Verify before you connect anything
Three commands confirm a working install: openclaw --version, openclaw doctor, and openclaw gateway status. For a gateway that survives reboots, openclaw gateway install registers it with the platform service manager — a LaunchAgent on macOS, a systemd unit on Linux, a Scheduled Task on Windows.
Connect a channel and a model
Telegram, WebChat and the agent-to-agent protocols A2A and Reef ship built in. The rest arrive as single-command official plugins — Discord, Slack, WhatsApp, Signal, iMessage, Matrix, Microsoft Teams, Google Chat, LINE, SMS and more, over thirty platforms. Telegram is fastest because it needs only a bot token; WhatsApp requires QR pairing. Text works everywhere, but media and reactions vary by channel.
Models are addressed as provider/model-name and set under agents.defaults.model.primary, so switching providers is a config change and a restart, not a reinstall. Running openclaw onboard handles provider-specific authentication, and since 2.0 it verifies the model responds before saving.
If nothing may leave the building, onboarding discovers Ollama and LM Studio, and OpenClaw runs local GGUF inference directly. Be realistic about the trade: local models are slower and weaker at tool use, and OpenClaw's own guidance recommends latest-generation models for tool-enabled agents. Before buying hardware, read our local LLM cost and hardware guide — the machine often costs more than a year of API calls.
What OpenClaw can actually do once it is running
It is a general-purpose agent with a chat front end, so its usefulness is bounded by the tools you give it. It is strongest on repetitive, judgement-light work: triaging an inbox and drafting replies for you to send, summarising a busy Slack channel into a morning digest, turning voice notes into structured notes, running a scheduled job that pulls numbers and messages you the result, and driving a browser through a supplier portal with no API.
It handles images, audio, video and documents both ways, plus web search. Cron jobs are built in, and multi-agent routing keeps sessions separate per workspace or per sender. If you are still deciding whether this class of tool fits, start with what AI agents actually do for a business.
How memory works now
This is where old guides are most wrong. Memory is not soul.md and agents.md any more. The current files live in the agent workspace: USER.md for preferences and style, MEMORY.md for durable facts loaded at session start, dated daily notes under memory/, and DREAMS.md for consolidation summaries. Behind them sits a SQLite memory engine with keyword, vector and hybrid search through a memory_search tool.
The rule is the documentation's own: the model remembers only what gets saved to disk. If it forgot something, the fix is a file, not a longer prompt.
Skills and plugins
Skills are markdown instruction files — a SKILL.md with YAML frontmatter and a body — installed with openclaw skills install @owner/slug from the ClawHub registry, from git, or locally. Plugins are heavier: they add channels, providers, tools, speech and search, and run in-process with full gateway privileges. Installing either runs someone else's code inside your agent, so pin exact versions and prefer an explicit plugins.allow allowlist.
Security: treat this like a privileged account, not a chatbot
The blast radius, plainly: a permissively configured OpenClaw can read and send messages on accounts you own, read and write files, execute shell commands, and drive a browser already logged into your services. If the model is manipulated, it acts with your credentials.
Some defaults are conservative — loopback binding, pairing for unknown senders. Two are not, and the documentation says so outright: sandboxing is off by default, and Secret Store values are not encrypted at rest, relying on the filesystem permissions of the state directory. The docs frame these controls as defence in depth that reduces capability, not hostile multi-user isolation. The Register covered this posture critically when 2.0 shipped, and Cisco researchers have flagged unvetted third-party skills as a data-exfiltration route.
Run openclaw security audit first — it reports drift from safe defaults, with --deep, --fix and --json available.
Decide who can talk to it
Direct messages have four policies. Pairing is the default: an unknown sender gets a time-limited code and is ignored until approved. Allowlist blocks unknown senders outright, Open requires an explicit wildcard, Disabled ignores inbound DMs. Where more than one human is involved, set session.dmScope to per-channel-peer so each sender gets an isolated context — without it, one person's private conversation can bleed into another's. In groups, require a mention before the agent responds.
Constrain what it can do
Command execution has three levels: deny, ask and full. Full is the default for a single trusted operator and the wrong choice for a business install. Start at deny, move to ask for the specific things you need, and widen only after watching it work for a week.
Set tools.fs.workspaceOnly so file access cannot leave the workspace, and pick a tool profile that matches the job — a messaging assistant does not need the automation, runtime and filesystem tool groups. Turn sandboxing on rather than assuming it is; Docker and Podman isolation supports none, read-only or read-write workspace access. The docs call it defence in depth that materially limits filesystem and process access, not a perfect security boundary.
There is a published hardened baseline doing most of this at once: loopback gateway with token auth, per-channel-peer DM scope, a messaging tool profile with the dangerous groups denied, workspace-only file access, execution denied with ask always, and WhatsApp on pairing with mention-gated groups.
Credentials, and what to never connect
Everything sensitive sits under ~/.openclaw: the openclaw.json config with tokens and allowlists, a credentials directory with channel auth and OAuth tokens, and SQLite state holding runtime secrets and transcripts. None of it is encrypted at rest, so filesystem access to that directory is total access to the agent. The documented compensating controls are permissions — 600 on the config, 700 on the directory — so set them, add full-disk encryption, and give OpenClaw its own OS user on a shared host.
Give it least-privilege credentials for every service, never an admin account. Do not connect production database writes, payroll, banking, your primary password manager or your domain registrar. If it gets browser control, give it a dedicated profile — the docs are explicit that the agent can reach any account with a live session there. And put approval gates on anything consequential: external email, moving money, deleting records, posting publicly.
Prompt injection and network exposure
The threat is not only who messages the agent, it is everything the agent reads: a fetched page, an attachment, a pasted log. OpenClaw's security docs cite a crowdsourced test of 272,000 attacks in which current frontier models were compromised at low single-digit percentages or below — reassuring until you notice it is not zero. The mitigations are structural: keep inbound DMs locked, treat links and attachments as hostile, use a read-only reader agent for untrusted content, sandbox tool execution, and prefer latest-generation models wherever tools are enabled.
Keep the gateway on loopback. For remote access the documented preference is Tailscale Serve over a LAN or public bind, because it keeps the gateway itself on loopback. Never expose it unauthenticated on 0.0.0.0, set gateway.trustedProxies behind a reverse proxy so client IPs cannot be spoofed, and keep browser control ports off the LAN.
Monitoring and incident response
Run openclaw security audit --deep on a schedule, read openclaw logs, and review session transcripts rather than assuming they are boring. Rotate gateway tokens and provider credentials periodically. If you suspect a compromise, the documented containment sequence is: kill the gateway, set the bind back to loopback and disable any tunnel, switch risky channels to a disabled DM policy, then rotate credentials before reviewing logs.
What OpenClaw costs to run
The software is free under the MIT licence. Model usage is where the money goes, billed by your provider on your own account, so cost scales with how much the agent thinks rather than with a seat count.
What drives spend: the system prompt including tools, skills and workspace files, the conversation history, tool calls and their results, attachments and media. Bootstrap files are capped at 20,000 characters each and 60,000 in total, which is useful discipline — a bloated MEMORY.md is a recurring bill. Reduce spend with /compact on long sessions, trimmed tool outputs, lower image resolution and smaller models for exploratory work.
Visibility is good: /status gives a session overview, /usage tokens shows per-response detail, /usage full includes estimated costs, and openclaw status --usage normalises provider quota windows. The gap is control — the token-use docs cover visibility but document no built-in hard spend cap. Set your ceiling in the provider console instead, with alerts well below it so a runaway loop reaches you before it reaches your limit.
For scale: across the automation builds we run, clients typically spend $30-150 per month on model usage, paid directly to the provider with no markup from us. Add a small VPS if you want it always on. Hardware only dominates if you go fully local, which is why our guide to self-hosted AI for business spends as long on the arithmetic as the architecture.
Who should run OpenClaw, and who should not
Good fit: a technically confident owner or operator who wants an assistant on their own hardware, a small team with someone comfortable in a config file, and anyone whose binding constraint is that data must not sit in a third-party product. It rewards people who will maintain it — this project ships frequently, and an unmaintained agent rots.
Poor fit: anyone needing a supported product with an SLA, a regulated environment where you must evidence exactly what an autonomous system did and why, or a team where nobody owns the install. It is also wrong if you want one reliable workflow rather than a general assistant — a narrow, deterministic automation is cheaper to run and far easier to audit. And because the security model assumes one trust boundary per gateway, one shared instance for a whole company with mixed access levels is not the shape this tool has.
Troubleshooting the setup failures people actually hit
Command not found after install: your npm global bin directory is not on PATH. Fix the shell profile rather than reinstalling.
Install fails or the gateway will not start: check Node against the version floor, then run openclaw doctor, then openclaw gateway status, then read openclaw logs. Doctor catches most of it.
WhatsApp keeps dropping: a single gateway per host owns the WhatsApp session exclusively, and two gateways fighting over one account produce exactly this symptom.
The model saves but every request errors: re-run openclaw onboard. Since 2.0 the flow verifies the model can answer before saving, so a fresh pass surfaces a bad key or wrong endpoint immediately.
A plugin does not appear: restart the gateway, since plugin code loads at start. If it still does not register, check the install source is trusted and filesystem ownership correct — the loader refuses plugins without clear provenance.
Upgrading from 1.x: back up ~/.openclaw and verify the backup first. The migration moves sessions into SQLite and is not designed to be reversed.
OpenClaw FAQ
The questions that come up most once people are past the install.
Is OpenClaw free?
The software is free and MIT licensed. You pay for model usage on your own provider account, plus hosting if you run it somewhere other than a machine you already own.
Do I need to be a developer to set it up?
You need to be comfortable running a terminal command and editing a config file. The 2.0 installer and desktop apps removed a lot of friction, and much configuration now happens by talking to the agent. But when something breaks you will be reading logs.
Can I use my ChatGPT or Claude subscription instead of an API key?
The 2.0 onboarding scans for AI access you already have, including Codex, ChatGPT and Claude logins as well as stored API keys, and several providers list more than one authentication route. Whether a given subscription is usable this way depends on that provider's terms, so check first.
Can OpenClaw run entirely offline on local models?
Yes for the model layer: it discovers Ollama and LM Studio and runs local GGUF inference. No for the channels — a WhatsApp or Slack integration sends messages through those platforms by definition. Fully offline means WebChat and local channels only.
Is it safe to connect my work Slack or WhatsApp?
Not out of the box: sandboxing ships off and the secret store is unencrypted. It can be, with least-privilege credentials, DM pairing on, mention-gating in groups, execution set to deny or ask, workspace-only file access, sandboxing enabled and approval gates on anything consequential.
Do I need a VPS, or will my laptop do?
A laptop is fine for evaluation. For an assistant that answers overnight or runs scheduled jobs, use an always-on host — a small VPS or a spare Mac mini — with the gateway installed as a managed service.
How do I upgrade from an older OpenClaw install?
Back up ~/.openclaw and verify the backup, then upgrade through the route you installed with. The SQLite session migration is the part that matters: older releases cannot read sessions created after it.
Is OpenClaw the same thing as Clawdbot or Moltbot?
Same project, different names. It was published as Warelay in November 2025, renamed Moltbot on 27 January 2026 after trademark complaints from Anthropic, and renamed OpenClaw three days later. Any guide using the old names predates 2.0, and its install steps will not work.
If you would rather have it built and documented properly
Running your own agent buys control over your data, your models and your costs. It also makes the maintenance, the permission model and the incident response yours — a fair trade when someone owns it, a bad one when the install ends up orphaned on a laptop with full shell access and no monitoring.
We build this kind of system for clients as owned infrastructure — your servers, your API keys, no per-seat licence to us. Builds start at $7,500, typically delivered in about 30 days, or 4-8 weeks for a larger MVP; model costs stay on your own provider account in the $30-150 per month range above. Our self-hosted solutions page covers that work.
Not ready for a conversation? Take the free automation audit — a three-minute questionnaire returning an automation health score, what manual work costs you annually, and a ranked list of quick wins. No call, no cost, and it will tell you whether an agent like OpenClaw solves your actual bottleneck.