OpenClaw: installation, models, security, and costs

OpenClaw is a self-hosted AI assistant that connects a language model, tools, and conversation interfaces. To use it, you install its Gateway, configure model access, and grant the permissions your tasks require. The software does not eliminate external service costs or your responsibility to oversee the actions it performs.

Understand the components before installing

The Gateway is the operational hub of your installation. It receives messages and connects them to sessions, models, and configured capabilities. The model generates responses and selects actions; tools carry out the operations you have authorized.

Understanding this separation makes troubleshooting easier. An accessible dashboard does not prove that the model provider accepts your credentials. A successful browser conversation does not prove that your messaging setup authorizes the right sender. A model can also describe an operation without having the tool needed to perform it.

OpenClaw belongs to the personal assistant category covered in our AI agent directory. Its usefulness depends largely on whether you need to connect conversations to actions. If you only write an occasional piece of text, maintaining a service and its permissions may create unnecessary work.

Start by defining a task with a result you can check: summarize a folder of sample documents, prepare a draft, or produce a file list. Keep payments, deletions, and actual message sending out of the first test. This lets you assess response quality separately from whether the connections work.

This guide covers ongoing operation. Install OpenClaw step by step complements it with an installation walkthrough organized by operating system.

Prerequisites and choosing a machine

The official getting started documentation, accessed on October 24, 2026, specifies Node.js 24.16 or later within that release line, or 26.1 or later, and recommends Node.js 26. It requires compatible model access; the setup wizard can also detect some credentials already available on your machine.

Before starting, prepare:

A machine on which you can install software.
A dedicated system account if the agent will run regularly.
A working directory containing only the data it needs.
Model access and a way to monitor usage.
A backup of any documents the agent will be allowed to modify.

Criterion	Personal computer	Dedicated server
Availability	Depends on sleep and shutdown settings	Can remain continuously available
Document access	Documents are already present but need access boundaries	Requires planned transfers or synchronization
Maintenance	Adds to workstation maintenance	Requires system, remote access, and backup management
Isolation	Requires restricting accessible directories	Easier to arrange on a separate host

A server is not automatically safer. An exposed service without access controls can pose more risk than a restricted local installation. Choose based on required availability, your ability to administer the system, and the data involved. There is no need to size the machine for a local model if you will use a remote API.

1. Install OpenClaw and start a conversation

The following commands follow the official getting started process linked above. On macOS or Linux, the suggested installation command is:

curl -fsSL https://openclaw.ai/install.sh | bash

On Windows, the documented PowerShell command is:

iwr -useb https://openclaw.ai/install.ps1 | iex

These commands download and execute a script. Check the domain and inspect the script if your IT policy requires it. Do not grant the agent administrator privileges simply because a dependency needed them during installation.

The installer launches guided setup. Start with the simple setup path if the detected credentials belong to the account you intend to use; choose custom setup to review the options. Leave additional connections aside at this stage.

If the Gateway is running in the foreground, stop it using the keyboard shortcut shown in the terminal before installing its service:

openclaw gateway install

Then check the service and open the interface:

openclaw gateway status
openclaw dashboard

Send a request with no external effect, such as asking it to rephrase some text. A response confirms that the initial path from the interface to the model works. Avoid testing a messaging channel and a skill at the same time: if the test fails, you will not know which layer needs attention.

Keep useful installation details, but remove keys, tokens, and access links before sharing a screenshot or report.

2. Configure the working directory, instructions, and access

The configuration reference identifies ~/.openclaw/openclaw.json as the usual configuration file, using JSON5 format. Its schema is strict: unknown keys or invalid values can prevent startup. Begin with the wizard or interface forms instead of examples copied from old discussions.

To revisit the settings:

openclaw configure

The working directory should have a clearly defined scope. Avoid granting access to your entire home directory to process a few documents. Put test files in a separate location and check the permissions of the account running the service.

Your instructions should specify the expected result, permitted sources, files that may be modified, and operations requiring approval. For example: prepare drafts, preserve originals, and request confirmation before sending anything. These instructions guide the model; technical restrictions must prevent prohibited operations.

Also distinguish persistent instructions from task data. A document you receive may contain a command without granting any authority to act on it. The agent should treat that content as material to analyze, rather than as a change to your rules.

Before any significant change, back up the configuration and record what you want to achieve. Change a coherent group of settings, check startup, and repeat your reference task. This makes it easier to return to a known working state.

3. Choose a model and verify authentication

Your choice involves a provider and model combination, authorized access, and capabilities suited to the work. The model documentation distinguishes the primary model, fallback models, and authentication profiles. It also explains that the execution mechanism and billing method are separate questions.

Start by checking what your installation recognizes:

openclaw models status
openclaw models list

Use the identifiers supplied by the catalog and the provider’s documentation. Similar product names do not guarantee compatibility or access rights.

Criterion	Model accessed through a remote API	Locally hosted model
Main expense	Usage and associated services	Hardware, electricity, and administration
Data flow	Content sent to the provider	Must be checked across the entire tool chain
Available capabilities	Depend on the catalog and quotas	Depend on the hardware and model
Troubleshooting	Credentials, limits, availability	Loading, memory, inference server

A platform such as OpenRouter adds another intermediary to account for when assessing data flow and costs. Software such as Ollama serves a different purpose: running models on a machine you administer. In either case, check the officially supported integration process before configuring the endpoint.

Evaluate the model on your own tasks: whether it respects boundaries, chooses appropriate tools, handles errors, and produces an acceptable result. A low price per response does not offset repeated attempts or extensive manual corrections. Check fallbacks as well: they can change both the provider receiving your data and the actual cost.

4. Add skills without expanding permissions by default

A skill describes how and when to use capabilities. According to the official skills documentation, it consists of a directory containing a SKILL.md file with YAML metadata and Markdown instructions. Whether it loads can depend on configuration, the environment, and available programs.

Keep these three elements separate:

The skill explains a method.
The tool performs an operation.
Permissions determine what that operation can access or affect.

A skill may therefore appear in the installation without being usable, or describe a procedure that conflicts with your restrictions. Conversely, a short set of instructions can invoke a very powerful program.

Start with the capabilities already available. If you add an external skill, examine its source, instructions, scripts, and dependencies. Look for executable downloads, access to secrets, network transmissions, and permission changes.

Scope matters too. The documentation gives working directory skills priority over several other sources, including bundled skills. A local copy can therefore change the behavior you expect. Check for name collisions and keep a record of modifications.

Test each addition with sample data and limited access. An automated scan or signature does not prove that the procedure is appropriate for your use. If you are preparing a reusable skill, the agent skills guide explains how to separate instructions, resources, and verification.

5. Connect a messaging app and control who can send requests

A messaging app creates a remote entry point to your agent. Connect it only after verifying the model and tools through the local interface. Otherwise, a channel error can obscure an authentication failure or invalid configuration.

The channel documentation presents Telegram as the simplest starting point, using a bot token. WhatsApp uses QR pairing and stores more state on disk. Slack and Discord are also documented channels; review their permissions and behavior separately.

For Telegram, follow this sequence:

Create the bot using the channel’s official procedure.
Save its token through the designated configuration process.
Verify which identity is authorized to converse with the agent.
Send a request with no external action in a private conversation.
Test the restrictions before adding a group.

Never post the token in a support conversation. If you disclose it, revoke it through the relevant service.

In groups, distinguish permission to see a message, trigger a response, and authorize an action. Requiring a bot mention can reduce interruptions; it does not replace a list of authorized users.

Finally, check which recipients the messaging tools can reach. Reading a conversation and sending a message are separate permissions. Before professional use, explicitly test that a user cannot have data forwarded to another space without your approval.

Security: limit the consequences of mistakes

The OpenClaw security documentation describes a shared trust boundary within the Gateway. For users who do not trust one another, it recommends separate installations and credentials, ideally with separate system accounts or hosts. It also notes that network settings differ between standard installations and containers.

Run the documented audit:

openclaw security audit

Read the findings and check the effects of any proposed fixes. A configuration audit does not guarantee that a business task is sensible or that an external document is trustworthy.

Prompt injection becomes a risk when content the agent reads tries to redirect its behavior. Limit the possible consequences through restricted directory access, dedicated accounts, disabled unnecessary tools, and approval before sending, deleting, or making financial commitments.

An isolated environment protects only what it actually separates. Examine mounted directories, network access, available secrets, and accessible browser profiles. A browser that is already signed in can provide access to sensitive services even if you have not explicitly supplied the agent with an API key.

Apply least privilege to tools and external accounts. Written instructions should supplement these restrictions rather than replace them.

The guide to securing an AI agent provides a broader framework for secrets, approvals, and logging. Reassess that framework whenever you add a channel or tool.

Costs: measure the entire task

The absence of a software subscription fee does not mean there are no expenses. The official OpenClaw website, accessed on October 24, 2026, presents the project as having no subscription or hosted offering. Your installation may still use paid APIs and require hosting.

Break your budget into categories: the primary model, any fallbacks, search or media processing, the machine, storage, and maintenance time. A tool call can incur a separate charge, independently of the model’s token usage.

To estimate model usage, add up the inputs and outputs of every call. Conversation history, instructions, and tool results may be sent again as the task progresses. A short final response can therefore involve substantial intermediate work.

The LLM pricing calculator helps you build an estimate; compare it with the provider’s usage records afterward. Check special pricing categories separately, including caching and media processing, where applicable.

Set a spending limit with the provider when one is available. An alert tells you about usage; it does not necessarily stop further spending. Also measure the cost per accepted task, including retries and human corrections.

To reduce costs, begin by limiting the documents sent, available tools, and unnecessary recurring tasks. Then try a different model using the same tests to check whether the savings affect the result you need.

Common problems

The dashboard opens, but no response arrives. Check the model’s status and credentials. Distinguish denied access, an exhausted quota, and an unavailable model before changing the Gateway configuration.

The service will not start after a change. Strict validation may reject an outdated key or an incorrect value. Run the diagnostic:

openclaw doctor

Compare the error with your most recent change. Avoid layering on more changes until you have restored a working state.

A skill is present but does not work. Check its scope, dependencies, and environment restrictions. Do not address a missing dependency by granting unrestricted access.

The bot does not respond in the messaging app. First confirm that the local conversation works. Then check the sender’s identity, pairing, channel permissions, and group rules.

Usage continues outside expected conversations. Look for recurring tasks and additional calls in the available usage records and logs. Pause the relevant automations while investigating.

A sensitive connection appears compromised. Disable the affected access, revoke exposed credentials, and preserve useful evidence without publishing it. Restoring a configuration file does not revoke a stolen token.

Checklist before regular use

A ready installation should complete a representative task and refuse an out-of-scope request. Keep these tests so you can repeat them after an update or model change.

Frequently asked questions

Does my computer need to stay on to use OpenClaw?

The machine running the Gateway must remain available to process messages. Installing it as a service lets it run without an open terminal, but does not keep a computer running when it is shut down or asleep. For continuous availability, choose a suitable host and plan for its maintenance.

Can I use OpenClaw without connecting a messaging app?

Yes. The dashboard lets you start with a conversation in your browser. This is a useful way to check the model and tools separately before adding an external channel.

Can OpenClaw use my AI assistant subscription?

That depends on the provider, the authentication method, and the officially supported setup. A subscription to a chat interface does not automatically include API credits. Check which account is actually being used and its terms before running recurring tasks.

Can a skill work without additional software?

Some skills consist only of instructions; others require an installed program, a key, or an accessible service. Having the skill file does not guarantee that it will work. Check its dependencies and the environment in which it runs.

Can multiple clients share one installation?

Do not treat a shared installation as a security boundary between clients who do not trust one another. The documentation recommends separate Gateways and credentials when trust boundaries differ. That separation should also extend to system accounts and accessible data.

OpenClaw reference guide: installation, configuration, models, skills, messaging, security, and costs