OpenClaw VPS Setup Guide 2026: Requirements and Security

Published on

How to run OpenClaw on a VPS: Node 24 or 26, 1 GB RAM minimum and 2 GB advised, the install steps from its docs, private dashboard access and which plan fits.

A smartphone on a grey sheet with lines of code on its screen

Short answer: OpenClaw fits on a small Linux VPS. Its own docs list 1 vCPU and 1 GB of RAM as the absolute minimum and recommend 2 GB or more. You install Node 24 or 26 and OpenClaw, run openclaw onboard --install-daemon as a normal user, turn on lingering so the service survives logout, and connect an Anthropic or OpenAI API key. The Gateway stays on loopback, and you reach its dashboard through an SSH tunnel or Tailscale. Never open port 18789 to the internet.

Below: what OpenClaw is, what it needs, every setup step with the commands from OpenClaw's docs, what this year's security reports mean for a server, and which plan to pick. Everything here was checked on 28 October 2026.

What OpenClaw is

OpenClaw is an open source personal AI agent. You talk to it from chat apps you already use, such as WhatsApp, Telegram, Discord or Slack, and it acts for you with the tools and skills you give it. At its center sits the Gateway, which OpenClaw's runbook describes as "one always-on process for routing, control plane, and channel connections." That process has to stay up, and OpenClaw's hosting FAQ is plain about the laptop problem: sleep and network drops disconnect it.

The software is free. It is MIT licensed, the license names the OpenClaw Foundation as copyright holder, and the project's website describes that foundation as "an independent US 501(c)(3) non-profit" with no paid version. On 28 October 2026 its GitHub repository had more than 393,000 stars.

It is not an OpenAI product. Its creator, Peter Steinberger, works at OpenAI, and OpenAI is one of the foundation's donors, but the website says it in so many words: "OpenClaw is not an OpenAI product."

It also had two earlier names. The project began in November 2025 as Clawd, a pun on Claude, in a repository named clawdbot. After Anthropic's legal team asked for another name it became Moltbot, and on 29 January 2026 Steinberger announced the name OpenClaw. The old GitHub addresses clawdbot/clawdbot and moltbot/moltbot still lead to the same repository.

The AI model does not run on your server. Claude runs at Anthropic and GPT at OpenAI. Your VPS runs the Gateway, its chat connections, its memory and workspace files, and the commands the agent executes, which is why no GPU is needed. It also means every request runs on your own API key or plan, and the usage limits of that key or plan apply. A VPS doesn't lift them.

OpenClaw VPS requirements

From OpenClaw's install page and its hosting FAQ:

  • Node.js: 24.16.0 or newer on the 24 line, or 26.1.0 or newer. Node 26 is the recommended line, and the docs strongly recommend 24.22.1+ or 26.12.1+ for the security fixes. When Node is missing on Linux, the installer script sets up Node 24 LTS for you.
  • CPU and RAM: 1 vCPU and 1 GB of RAM is the absolute minimum. The recommendation is 1 to 2 vCPU and 2 GB or more, for logs, media and several channels, and the FAQ warns that "Node tools and browser automation can be resource hungry."
  • Disk: roughly 500 MB at the absolute minimum, plus room for logs, the workspace and backups.
  • Operating system: Ubuntu LTS or another modern Debian or Ubuntu, which the FAQ calls "the best-tested Linux install path."
  • A model provider: for example an Anthropic or OpenAI API key. More on that below.

OpenClaw's own DigitalOcean guide shows how small that can be. It uses 1 vCPU, 1 GB of RAM and 25 GB of disk on Ubuntu 24.04 LTS, adds 2 GB of swap, and tells you to move to a 2 GB server if memory still runs out. It also says to stick to API-based models, because "local LLM inference does not fit in 1 GB." If you want local models anyway, our guide to Ollama on a CPU-only VPS explains what to expect.

One more line from that guide is worth repeating: use a clean base image and avoid third-party one-click images "unless you have reviewed their startup scripts and firewall defaults."

OpenClaw VPS setup, step by step

The commands below are copied from OpenClaw's DigitalOcean guide. None of them depend on DigitalOcean; they are ordinary commands for Ubuntu 24.04. If this is your first server, read our Linux VPS beginners guide first for SSH keys and the first login.

1. Update the server and install Node and OpenClaw

Log in as root over SSH and run:

apt update && apt upgrade -y

# Install Node.js 24 LTS
curl -fsSL https://deb.nodesource.com/setup_24.x | bash -
apt install -y nodejs

# Install OpenClaw; run onboarding later as the non-root owner.
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard

The --no-onboard flag installs OpenClaw without starting the setup wizard. The guide uses root only to prepare the system. Everything after that is done by a normal user who owns the agent's files and its service.

2. Create the OpenClaw user and turn on lingering

# Create the non-root user that will own OpenClaw state and services.
adduser openclaw
usermod -aG sudo openclaw
loginctl enable-linger openclaw

su - openclaw
openclaw --version

loginctl enable-linger is the line that keeps your agent alive. OpenClaw runs the Gateway as a systemd user service, and the runbook is short about why lingering matters: "For persistence after logout, enable lingering." It calls a user service with lingering "the supported way to keep the Gateway running without a login session." If you set things up under your own user instead, the runbook's version of the command is sudo loginctl enable-linger $(whoami).

3. Run onboarding and install the service

As the openclaw user:

openclaw onboard --install-daemon

The wizard walks you through model auth, channel setup, the Gateway token and the systemd user service. When it asks for model auth, choose the API key option for Anthropic or OpenAI. In the default token mode, onboarding generates the Gateway token and stores it in the config as gateway.auth.token. You need that token to log in to the dashboard.

4. Add swap (optional on 2 GB)

The guide recommends swap for 1 GB servers. On 2 GB you can skip it or add it as a safety margin:

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

5. Check that the Gateway runs

openclaw status
systemctl --user status openclaw-gateway.service
journalctl --user -u openclaw-gateway.service -f

If the Gateway won't start, the guide's first step is openclaw doctor --non-interactive, followed by a look at the service log. If systemctl --user itself fails on a headless server, the runbook has you run export XDG_RUNTIME_DIR=/run/user/$(id -u) and try again.

Connect Claude or GPT with an API key

For Claude, create a key in the Claude Console and pick "Anthropic API key" during onboarding, or pass the key and check the result as OpenClaw's Anthropic page shows:

openclaw onboard --anthropic-api-key "$ANTHROPIC_API_KEY"
openclaw models list --provider anthropic

Use a key here, not a Claude subscription. Anthropic's legal and compliance page says subscription sign-in is designed "to support ordinary use of Claude Code and other native Anthropic applications," and that Anthropic does not permit third-party developers "to route requests through Free, Pro, or Max plan credentials on behalf of their users." OpenClaw's Anthropic page points the same way: "Anthropic token auth expires and can be revoked. For new setups, use an Anthropic API key instead." A key is billed per use, which OpenClaw calls "preferable for shared automation or predictable production spend."

For GPT, create a key in the OpenAI Platform dashboard and follow OpenClaw's OpenAI setup page:

openclaw onboard --auth-choice openai-api-key
openclaw models list --provider openai

OpenAI also lists OpenClaw as an open source integration on its Sign in with ChatGPT page, so eligible ChatGPT Plus and Pro subscribers can use their plan instead of a key. OpenClaw's OpenAI setup page still marks that sign-in as Beta. OpenAI spells out the catch: "App usage counts toward your existing plan limits." Connecting OpenClaw does not add a new allowance. In ChatGPT you can cap OpenClaw's share of your weekly usage under Settings > Usage.

Whatever you connect, the credentials live on the server. OpenClaw's secrets page tells you to assume anything under ~/.openclaw/ may contain secrets or private data, and to keep permissions at 700 for folders and 600 for files. Guard that folder and your API keys like passwords. If you also run Codex CLI on the server, OpenAI's authentication docs say the same about its login file: treat ~/.codex/auth.json "like a password: it contains access tokens."

Reach the dashboard without opening port 18789

On a normal install the Gateway listens on 127.0.0.1, port 18789, and asks for a token. OpenClaw's Linux server page calls this the secure default: "keep the Gateway on loopback and access it via SSH tunnel or Tailscale Serve." Containers are the exception: inside one, the Gateway binds to 0.0.0.0 by default so that port forwarding works. Check the bind setting if you use the container image.

Option 1: an SSH tunnel. Run this on your own computer, as OpenClaw's remote access page gives it. Replace user@gateway-host with your SSH user and your server's IP address:

ssh -N -L 18789:127.0.0.1:18789 user@gateway-host

Then open http://127.0.0.1:18789/ in your browser and log in with the Gateway token, as OpenClaw's Linux page describes. The tunnel doesn't skip that step; in the runbook's words, "SSH tunnels do not bypass gateway auth."

Option 2: Tailscale Serve. If you already use Tailscale, the DigitalOcean guide sets it up like this:

curl -fsSL https://tailscale.com/install.sh | sudo sh
sudo tailscale up
openclaw config set gateway.tailscale.mode serve
openclaw gateway restart

Then open https://<magicdns>/ from any device on your tailnet. According to OpenClaw's Tailscale page, Serve keeps the Gateway on 127.0.0.1, so only your tailnet can reach the dashboard. Don't mix it up with Funnel, which puts the dashboard on the public internet behind a shared password.

What not to do. Don't bind the Gateway to every interface and open 18789 in the firewall. The network exposure page is blunt: "never expose the Gateway unauthenticated on 0.0.0.0." To see what the internet sees, run its check from another machine against your server's public IP:

nmap -sT -p 1-65535 <public-ip> --open

You should see SSH and whatever else you opened on purpose, and not 18789. Then run OpenClaw's own audit on the server, as its audit page describes:

openclaw security audit
openclaw security audit --deep    # attempts a live Gateway check
openclaw security audit --fix     # apply safe remediations

The audit checks who can message your agent, network exposure, weak tokens and file permissions. --fix is deliberately narrow: among other things it tightens state and config files to 600 and their folders to 700. For SSH itself, a firewall plus Fail2Ban is a sensible base, covered in our Fail2Ban and UFW guide.

What the 2026 security reports mean for your server

OpenClaw grew fast, and so did the reports about it. Here are the main ones, each with its original source:

  • CVE-2026-25253. The dashboard accepted a gateway address from a link and connected to it on its own, sending its stored token along. One click on a crafted link could hand that token to an attacker, and with it control of the Gateway and the machine it runs on. The GitHub advisory adds that this worked even on instances that listened on loopback only, because the victim's own browser made the connection. NVD lists a CVSS score of 8.8 (High). Version 2026.1.29 fixed it.
  • Exposed gateways. Censys counted 21,639 OpenClaw instances reachable from the internet on 31 January 2026, most of which still asked for a token. On 11 February SecurityScorecard's STRIKE team reported more than 40,000 exposed instances in its first 24 hours of scanning. It flagged 35.4% of the deployments it observed as vulnerable, many of them to remote code execution.
  • Malicious skills. On 2 February 2026 VirusTotal reported hundreds of actively malicious OpenClaw skills: droppers, backdoors, infostealers and remote access tools posing as helpful automation. Its October follow-up looked at 35,878 skills for OpenClaw and other agents and classed 6,637 of them (18.5%) as malicious. In 62% of those there was no malicious code at all, only plain-language instructions for the agent to follow.

The project has answered in public. On 28 October 2026 its security page showed no active bulletins (status last reviewed on 9 September), 722 fixes published since January, 39 of them with a CVE, and 14 confirmed critical vulnerabilities, all fixed and disclosed. Every skill version on ClawHub, OpenClaw's skill registry, is now checked before it is listed, and ClawHub blocks installs of skills it marks malicious or quarantined. OpenClaw still warns, in its VirusTotal announcement, that "a clean scan doesn't mean a skill is safe."

What that means for your server:

  1. Update regularly. openclaw update is the recommended command: it detects how you installed OpenClaw, checks the new version while the old Gateway keeps serving, then switches over and verifies it. Loopback alone did not stop CVE-2026-25253. The update did.
  2. Keep the Gateway private, as described above.
  3. Install only skills you have read. In OpenClaw's own words, skills are "code that runs in your agent's context, with access to your tools and your data."
  4. Give the agent accounts of its own. For a team agent, OpenClaw's Linux server page advises a dedicated runtime that is not signed into personal Apple or Google accounts or personal browser and password manager profiles. That is good advice for a personal agent too, and a separate VPS makes it easy to follow.

Backups

OpenClaw keeps its config, credentials, auth stores and sessions in ~/.openclaw/, and the agent's workspace in ~/.openclaw/workspace/. The DigitalOcean guide makes an archive of both with:

openclaw backup create

Our VPS plans don't include backups, so copy those archives to another machine as well.

OpenClaw hosting: which plan fits

OpenClaw itself asks little. One Gateway on API models runs on 1 GB, and the docs recommend 2 GB or more. On our plans that works out like this:

  • One OpenClaw Gateway: VPS-XS Premium, €4.20 a month. 2 GB of DDR5 RAM, 2 shared vCores on an AMD Ryzen 9 9950X, 20 GB of NVMe storage and 5 TB of monthly transfer. That meets OpenClaw's 2 GB recommendation, and the disk is far above its 500 MB minimum.
  • OpenClaw plus Claude Code, or heavy browser automation: VPS-S, from €5.50 a month. Claude Code lists 4 GB of RAM as its minimum, and our Claude Code VPS guide covers its setup. VPS-S Standard has 4 GB of DDR4 and 3 shared vCores on an AMD EPYC 7452 for €5.50; VPS-S Premium has 4 GB of DDR5 and 2 shared vCores on the Ryzen 9 9950X for €8.40.
  • Several agents, or OpenClaw next to n8n or Docker: VPS-M, from €11.10 a month. 8 GB of RAM and 4 shared vCores on Standard. Our n8n requirements guide covers the n8n side.

Every plan is KVM with full root access, dedicated RAM, shared vCores, DDoS protection and NVMe storage in an EU data center. Prices include VAT, and billing is monthly. On Premium you pick the operating system in the order form, where Ubuntu 24.04 LTS is marked as recommended; Standard orders have no OS step, so ask for Ubuntu in a ticket after you order. You'll find these plans side by side on our AI agent VPS page. We sell the server; you bring the agent and your own AI account. Space-Node is not affiliated with the OpenClaw Foundation, Anthropic or OpenAI.

FAQ

How much RAM does OpenClaw need on a VPS?

OpenClaw's hosting FAQ gives 1 GB as the absolute minimum and recommends 2 GB or more. Its DigitalOcean guide runs on 1 GB with 2 GB of swap and says to move to a 2 GB server if memory still runs out. Local models are the exception: they don't fit on a server that small.

Does OpenClaw need a GPU?

No, not with API models. Claude runs at Anthropic and GPT at OpenAI, so the VPS only runs the Gateway and the tools it calls. A GPU only matters for local models, which OpenClaw's own guide steers small servers away from.

Can I use a Claude Pro or Max subscription with OpenClaw?

Use an Anthropic API key. Anthropic says subscription sign-in is designed for ordinary use of Claude Code and its own apps, and that it does not permit third-party developers to route requests through Free, Pro or Max plan credentials on behalf of their users. OpenClaw's docs also recommend an API key for new setups, because token logins expire and can be revoked.

Can I use ChatGPT Plus or Pro with OpenClaw?

Yes. OpenAI lists OpenClaw as an open source integration on its Sign in with ChatGPT page, for eligible Plus and Pro subscribers, and OpenClaw still marks that sign-in as Beta. That usage counts toward your plan's existing limits and adds no new allowance. Choose an OpenAI API key instead if you want separate, pay-per-use billing.

Should I open port 18789 to reach the dashboard?

No. Keep the Gateway on loopback and use an SSH tunnel or Tailscale Serve. OpenClaw's docs say never to expose the Gateway unauthenticated on 0.0.0.0, and Censys counted 21,639 OpenClaw instances reachable from the internet on 31 January 2026.

Does OpenClaw keep running after I log out of SSH?

Yes, if onboarding installed the systemd user service with openclaw onboard --install-daemon and lingering is on for that user with loginctl enable-linger. OpenClaw's runbook names lingering as the supported way to keep the Gateway running without a login session.

Which Linux should I install?

Ubuntu LTS. OpenClaw's FAQ calls it the best-tested install path, and its DigitalOcean guide uses Ubuntu 24.04 LTS. On our Premium plans the order form marks Ubuntu 24.04 LTS as recommended; on Standard plans, ask for it in a ticket after you order.

Do you install OpenClaw for me?

No. We have no one-click image yet, so you install and run OpenClaw yourself with full root access, using the steps above. Our support helps with the VPS itself by live chat, Discord and email, every day from 08:00 to 20:00 UTC.

Sources

All opened on 28 October 2026.