Separate from the UI and CLI paths. Use this only if you want to run your own agent infrastructure and are ready to manage isolation, auth, and network hardening.
High-risk route. This topic is moving fast. Verify OpenClaw docs before every deploy, every upgrade, and every internet exposure change. Read The Lethal Trifecta before setup, and do not connect OpenClaw to accounts, systems, or data you care about. This guide was updated February 4, 2026.
Skip the infrastructure headaches. z0.ai gives you the same agentic capabilities without managing servers, security patches, or network hardening.
!
Self-hosting gives control but adds real operational burden: patching, token security, network policy, and incident response.
OpenClaw documents that sandboxing is a helpful control but not a perfect security boundary. Build layered controls from day one.
Simple droplet-based setup with predictable networking. Keep OpenClaw private first, then publish only after auth and logging are proven.
Use Cloudflare as a zero-trust front door. Expose dashboard/API through Access policy instead of raw public ports.
Other current OpenClaw deployment docs include Northflank, Railway, and Hetzner. Pick based on your ops maturity and budget.
Start with the official install script in an isolated environment, then continue setup only after the install succeeds.
curl -fsSL https://openclaw.ai/install.sh | bash
WIZ
The recommended way to configure OpenClaw. One guided flow sets up your Gateway, model providers, channels, daemon, and skills.
openclaw onboard
Do not expose non-loopback endpoints without authentication. Keep provider keys in a secret store, never in shell history or dotfiles.
This ecosystem is volatile. Pin versions, track changelogs, and use staged rollouts. Never apply docs snippets directly to production.