OpenClaw Setup Guide: Deployment, Security and Costs

OpenClaw is an open-source personal AI agent you run yourself: you message it on WhatsApp, Telegram or Slack, and it sorts your email, researches, reads and writes files and carries out tasks. The more it can do, the more you need to decide first. Commands change between releases (the official install docs have them), so this guide covers the decisions instead: where to run it, what to connect, how to secure it, what it costs and who should set it up.

Key takeaway

OpenClaw is free, MIT-licensed software with no paid tier and no official hosted service. The real decisions are where it runs (your laptop, a dedicated machine or a cloud server), which model and chat apps it uses, and how much access it gets. Start locked down and open up gradually: keep the gateway off the public internet, require pairing for new contacts, enable the sandbox, give it its own accounts and approve anything it sends. Most of the cost is model usage and the machine it runs on.

What is OpenClaw?

OpenClaw is an open-source AI assistant that runs on your own computer or server and talks to you through the chat apps you already use. According to its official GitHub repository, it connects to WhatsApp, Telegram, Slack, Discord, iMessage, Microsoft Teams and more than 20 other channels, with companion apps for macOS, iOS, Android, Windows and Linux. One gateway can serve a single person or a whole team.

The repository also answers the usual questions: it’s MIT-licensed, was built by Peter Steinberger and the community, is stewarded by the OpenClaw Foundation, an independent non-profit, and has no paid tier, no hosted service and no token. State, memory and credentials stay on your hardware, while your prompts go to the model provider and chat platforms you configure. And the mascot is a space lobster (🦞), which is why Chinese-speaking users simply call it “the lobster”.

What can OpenClaw do, and who is it for?

OpenClaw suits busy people who don’t mind some configuration, such as founders, managers and consultants. The OpenClaw website lists organizing your inbox, sending emails, managing your calendar and checking you in for flights, as well as browsing the web, filling in forms, reading and writing files and running shell commands. The official FAQ names five everyday uses:

Personal briefings on your inbox, calendar and news.
Research and drafting of summaries, emails and documents.
Reminders and follow-ups on a schedule.
Browser automation: forms, data collection, repetitive web tasks.
Cross-device coordination: send a task from your phone, let the gateway run it on a server, get the result in chat.

OpenClaw is not a public customer-service bot: one gateway is meant for one trust boundary (you, or a team whose members trust each other), so answering strangers calls for a dedicated AI customer-service setup. Nor is it “set and forget”: the same FAQ recommends keeping a human in the loop for anything sent out. Let OpenClaw draft; you approve.

OpenClaw deployment options: laptop, dedicated machine, VPS or one-click hosting

Run OpenClaw on a VPS or a dedicated machine if you want it available around the clock; install it on your own computer if you just want to try it. The official providers and hosting FAQ is candid about the trade-offs:

Your own computer: no server cost, direct access to local files, a visible browser. But sleep, network drops and OS updates interrupt it. Good for testing.
A dedicated machine (Mac mini, home server, Raspberry Pi): always on and separate from your everyday computer. The FAQ calls a dedicated host “not required, but recommended for reliability and isolation”. You only need a Mac for iMessage or other macOS-only tools.
A VPS: always on, with a stable network, and chat channels work fine from a server. But it’s usually headless, file access is remote and updates go through SSH. The documented minimum is 1 vCPU and 1 GB of RAM, with 2 GB or more recommended and Ubuntu LTS as the best-tested OS.
One-click templates and managed platforms: the official Linux server page lists platforms with one-click setup, such as Railway and Northflank, and guides for DigitalOcean, Hetzner, Oracle Cloud and others. It’s the fastest route, but these are third-party platforms: the OpenClaw project doesn’t host anything itself, your configuration, chats and credentials live on that platform, and security is still your job.

Wherever it runs, the same page describes the secure default: keep the gateway bound to loopback (local connections only), reach it through an SSH tunnel or Tailscale instead of opening it to the internet, and back up its state and workspace regularly.

Which models and chat apps can OpenClaw use?

OpenClaw isn’t tied to one model provider, and its channels cover most major chat apps. The official provider directory includes Anthropic (Claude), OpenAI, Google Gemini, Mistral, DeepSeek, Qwen Cloud, Moonshot AI (Kimi) and many more, plus local models through Ollama or LM Studio. Two official warnings matter:

Agents that can act need strong models. The prompt injection guide says smaller, cheaper models are more susceptible to tool misuse and instruction hijacking, and advises against them for agents that run tools or touch files and networks.
Local isn’t automatically safer. The local models page notes that local models don’t include hosted providers’ safety filters. Keeping data on your machine is a real benefit, but it calls for tighter permissions.

The channel list covers WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Microsoft Teams, Google Chat, LINE and Matrix, plus Feishu and WeChat (the latter through an external plugin maintained by Tencent, direct chats only). The docs suggest starting with Telegram, which needs only a bot token. Get one channel working before adding another, and if OpenClaw will message people on your behalf, give it its own number or account.

How to connect OpenClaw to Telegram and WhatsApp

Telegram is the quickest channel to connect: you create a bot and give OpenClaw its token. WhatsApp needs more care, because OpenClaw signs in as a linked device on a regular WhatsApp account. The official Telegram setup guide and WhatsApp channel page have the current steps; in short:

Telegram: chat with @BotFather, run /newbot and add the token to OpenClaw’s configuration. Your first message to the bot returns a pairing code, which you approve on the gateway with openclaw pairing approve telegram <CODE>; codes expire after an hour. In groups, Telegram’s privacy mode hides most messages from bots, so either turn it off with /setprivacy or make the bot a group admin, then remove and re-add the bot.
WhatsApp: OpenClaw connects through WhatsApp Web as a linked device, not through Meta’s official WhatsApp Business Platform. You sign in with openclaw channels login --channel whatsapp by scanning a QR code, so on a server plan how the live code will reach your phone. The docs recommend a separate number, although a personal number works too; by default, unknown senders need pairing approval and groups must be allowlisted.

Because the WhatsApp channel runs on a regular account, keep it to personal-assistant use. WhatsApp can disable or suspend accounts that break its terms, and its terms of service for users outside Europe name bulk messaging and auto-messaging as impermissible, so messaging customers at scale belongs on the official business platform: our guide to WhatsApp AI agents for business compares the ways to set that up, and our AI customer service chatbot guide explains the rules.

OpenClaw security: start locked down, then open up

OpenClaw security comes down to two questions: who can instruct it, and what it can touch. It can read and write files, handle email and run commands, so a badly configured instance can do as much damage as a stolen account. The official security guide starts from conservative defaults: on a regular install the gateway accepts local connections only, and on most channels an unknown sender gets a pairing code instead of having their message processed. Build on that:

Least privilege, human approval. Enable only the tools and accounts it needs, read-only first. The OWASP Top 10 for LLM Applications (2025) lists Excessive Agency as LLM06, caused by excessive functionality, permissions and autonomy, and recommends avoiding open-ended tools such as shell execution, granting minimal permissions and requiring human approval for high-impact actions. For OpenClaw, sending email or messages, paying and deleting files should wait for your confirmation.
Isolation. OpenClaw’s sandboxing is off by default; turn it on so tools run in an isolated environment with a smaller blast radius. Use a dedicated machine, VM or OS user and a dedicated browser profile. The official security FAQ also recommends separate email, GitHub accounts and phone numbers for the bot, so access is easy to revoke, and advises against giving it full autonomy over your personal messages.
Secrets. API keys and channel tokens live on the gateway host. The secrets management docs warn that plaintext credentials in files the agent can inspect, such as openclaw.json or .env, stay readable by the agent; SecretRefs let you pull them from an external secret manager. Keep secrets out of prompts, tighten file permissions, encrypt the host’s disk and rotate any key you suspect has leaked.
Prompt injection. OWASP ranks prompt injection as LLM01. Its indirect form occurs when external content the model reads, such as websites or files, changes its behavior. OpenClaw’s prompt injection guide is explicit: even if only you can message the bot, the pages, emails, documents and attachments it reads can carry malicious instructions. Its advice: let a read-only “reader” agent without tools summarize untrusted content for the main agent, keep web search and the browser off for tool-enabled agents unless needed, and treat links and attachments as hostile by default.
Skills and plugins. The security FAQ says to treat ClawHub skills and third-party plugins as code you are choosing to trust: read them first, prefer trusted authors and pinned versions, and don’t grant them broad file, shell, browser or secret access.

Run the built-in openclaw security audit after every configuration change. For team use, respect the documented boundary: one gateway for people who trust each other, separate gateways for those who don’t, and no mixing of personal and company accounts on one runtime. Agents that run company processes, such as lead follow-up or order entry, are covered in our guide to AI agents for small business.

What does OpenClaw cost?

The software is free; you pay for the model, the machine and the upkeep.

Model usage: pay-per-token API access or a provider subscription. Agents use more tokens than plain chat, because each turn carries context, tool definitions and history, and scheduled tasks keep running when you’re not watching.
Server or hardware: a monthly VPS bill, or a dedicated machine plus electricity; local models need hardware with enough memory.
Third-party services: for example SMS through Twilio, web search APIs or a hosting platform’s plan.
Maintenance: updates, security reviews and backups, paid in time or service fees.

OpenClaw’s usage tracking offers /usage cost in chat, a local cost summary built from session logs, and a Usage view in the Control UI. Set budget limits with your model provider too.

Should you set up OpenClaw yourself or hire someone?

Set it up yourself if you’re comfortable with the command line and servers and you’re trying it personally, without work email or sensitive files. Bring in someone experienced if it will run long-term on a server, connect several channels, touch company email or business systems, or be shared by a team. The onboarding wizard checks model access, creates the workspace and configures the gateway, so installing isn’t the hard part; permissions, secrets and ongoing updates are.

Whoever sets it up, you should be able to answer these questions at handover:

Which machine does it run on, and who has admin access?
Which tools and accounts are enabled, and which actions need your approval?
Where are the secrets, and how is it updated and backed up?
Are all accounts, keys and servers in your name?

FAQ

Is OpenClaw free?

Yes. OpenClaw is MIT-licensed open source with no paid tier and no official hosted service. You pay for model usage (API or subscription), the server or device it runs on and any third-party services you add; professional setup and maintenance are extra.

Is OpenClaw safe?

It can be, if configured carefully: most of the risk comes from configuration and use. Because OpenClaw can read and write files, handle email and run commands, an internet-exposed gateway, open DMs, broad permissions or a web page with hidden instructions can lead to data leaks or unwanted actions. Least privilege, sandboxing, separate accounts, approval for sensitive actions and the official security audit reduce that risk considerably.

Do I need a Mac mini to run OpenClaw?

No. The official FAQ calls the Mac mini a popular always-on host, but a small VPS, a home server or a Raspberry Pi-class device works too, and the installer supports macOS, Linux and Windows. You only need a Mac for iMessage or other macOS-only tools.

UsualMatrix sets up and configures OpenClaw for individuals and teams: where it runs, which models and chat apps it uses, permissions and secrets, which actions need your approval, and how to use it day to day. We work with clients worldwide in Chinese, Spanish and English. See our AI solutions or contact us.

Note: this article reflects OpenClaw’s official documentation and GitHub repository as of 3 October 2026. The project moves quickly, so check the latest official docs for current defaults, channels and install steps.