OpenClaw Install Guide: Requirements, Setup Steps, and What to Prepare

Most people search for an install command. What they actually need is a plan. A good OpenClaw install is one command plus a set of decisions: where it runs, which API key it uses, which channel it talks through, and what it is allowed to do without asking you first. This guide walks through all of it, in order, so nothing stalls halfway.

The official quickstart is honest: with Node ready and an API key in hand, the install, onboarding, and first chat flow can get you running in about 5 minutes. That number is real, but it describes a demo, not an operating setup. A business-grade OpenClaw setup adds host selection, credential hygiene, channel testing, skill review, and security hardening. This guide serves the DIY path first, step by step. At the end, you will also see exactly what ClearSetup handles if you would rather skip to a finished, hardened install. If you have been researching how to set up OpenClaw the right way, this is the checklist to bookmark.

OpenClaw install at a glance#

Here is the whole job in one sentence. You pick a machine that stays online, confirm the runtime, prepare credentials, run the installer, complete onboarding, connect a chat channel, verify the Gateway, and then lock the setup down before giving it real work. Every step is simple. The failure mode is skipping the preparation and discovering the missing piece mid-install.

Security belongs inside the install, not after it. OpenClaw is a capable agent that can read, draft, and prepare work freely. The line you draw during setup is the approval gate: anything that sends, deletes, spends, or changes a record should require a human yes. If you set that expectation on day one, every workflow you add later inherits it.

The rest of this guide expands each stage. Follow it top to bottom and you will finish with a system you can actually leave running.

OpenClaw requirements checklist before you start#

Start with the OpenClaw requirements, because almost every failed setup traces back to a missing prerequisite rather than a broken installer. The runtime requirement is specific: OpenClaw needs Node.js 22.19+, 23.11+, or 24+, and the docs recommend Node 24. Check your version with node -v before anything else. If the version is wrong, fix that first and save yourself the most common troubleshooting session.

Before you run the installer, confirm all six of these:

• Hardware. An always-on Mac, Linux box, Windows machine, WSL2 setup, or a dedicated host. Sleep is the enemy of a reliable agent.
• Runtime. A supported Node.js version, verified with node -v, not assumed.
• Accounts. A model provider account with an API key, a billing method, and usage limits already set.
• Channel. Your first messaging channel chosen in advance so the first test message is not blocked by a missing bot token.
• Security decisions. Who can approve actions, where secrets live, and whether the Gateway stays private. It should.
• Time. A quiet hour. The quickstart takes minutes, but verification and hardening deserve unhurried attention.

That is the full list of OpenClaw requirements for a serious setup. Nothing exotic, but every item matters at a specific moment during onboarding.

Choose where OpenClaw should live: Mac mini, workstation, VPS, or lightweight host#

Your host decision shapes everything downstream: uptime, channel compatibility, privacy, and how often you have to touch the machine. The question is not which computer can run OpenClaw. Almost any modern machine can. The question is which machine can run it all day, every day, without you babysitting it.

Use a daily laptop only to evaluate. Sleep, restarts, and travel will interrupt channel connections at the worst times. Choose a private VPS when you prefer remote management and do not need local-only integrations like iMessage; choose local hardware when you want everything on a machine you own. Small single-board devices are fine for experiments. For anything you will rely on, dedicate the host.

Prepare API keys, accounts, and channels before the install#

Onboarding asks for a model provider API key from a provider such as Anthropic, OpenAI, or Google. If you create that key while the installer waits, you will rush it. Prepare credentials first, deliberately, and the install becomes a formality.

Three habits make this layer clean:

• One key per job. A dedicated API key for OpenClaw means you can rotate or revoke it without breaking anything else you own.
• Billing before pasting. Add usage limits and alerts before the key touches onboarding, not after the first surprising bill.
• Channel picked on purpose. Choose based on speed, privacy, team visibility, and reliability. Telegram is usually the fastest first channel because it uses a simple bot token and no plugin install.

How to install OpenClaw on macOS, Linux, WSL2, or Windows#

With preparation done, the install itself is short. If you have been searching for how to set up OpenClaw, this is the core sequence. The official installer detects your OS, installs Node if needed, installs the CLI, and hands you to onboarding.

Whichever path you choose, the endpoint is the same: the openclaw CLI available in your shell and ready for onboarding. If the command is not found after the installer finishes, open a new terminal so your shell picks up the updated path.

Run onboarding for your baseline OpenClaw setup#

Onboarding is where the install becomes a working system. The official quickstart command is:

openclaw onboard --install-daemon

This guided flow walks you through model provider selection, API key entry, Gateway configuration, workspace creation, and daemon installation so OpenClaw survives restarts. The GitHub README describes onboarding as setting up the Gateway, workspace, channels, and skills, and it works on macOS, Linux, and Windows. Because you prepared your key and channel token already, every prompt has a ready answer.

OpenClaw has three related commands, and knowing which one to reach for saves confusion later:

The pattern to remember: onboard once, configure forever. When you want to change a credential or add a channel next month, that is openclaw configure, not a rerun of onboarding.

Connect your first messaging channel#

A channel is how you actually talk to your agent. iMessage, Telegram, and WebChat ship with OpenClaw out of the box, and channel plugins add Discord, Slack, Google Chat, WhatsApp, Signal, Microsoft Teams, Matrix, and Feishu. Channels can run simultaneously, and OpenClaw routes per chat, so your first choice is not a commitment. It is a starting point.

Adding an account is a single CLI command. Telegram, for example:

openclaw channels add --channel telegram --token YOUR_BOT_TOKEN

Then prove the channel before relying on it. Send a first message and confirm a reply. Run a channel probe to confirm status. Restart the host and send another message. A channel that survives a reboot is a channel you can build on.

Install skills and plugins with a vetting workflow#

Skills are where OpenClaw gets its range, and where careless setups get hurt. Do not install a skill just because it looks useful. ClawHub publishes security audits, and the audit docs are direct about their limits: audits are not a guarantee that a release is risk-free. Treat every skill like a new hire with system access, because that is what it is.

The review itself takes minutes when you know what to look at:

• Trust signals. Audit status, risk level, findings, owner, source, version, changelog, downloads, and stars. The ClawHub audit docs list exactly these as the pre-install review set.
• Permissions and credentials. What does it want to read, and what can it touch? A skill that requests more than its job needs is a skip.
• Sandbox first. Test in a low-risk workspace before connecting production tools or real accounts.
• Approval before action. A new skill should not send external messages, write files, update records, or take irreversible actions without a human yes.
• Keep a register. A simple list of installed skills, owners, permissions, and review dates turns future audits from archaeology into a checklist.

Security hardening basics and approval gates#

This is the section most guides bolt on at the end. It belongs inside your OpenClaw setup from the first hour, because retrofitting security onto a live agent is harder than starting with it. The official security docs give you the baseline, and it is not complicated.

The specifics, straight from the security documentation:

• Use shared bearer token or password auth. The docs identify shared bearer token auth as the recommended mode for most setups. Loose access is not a convenience, it is an incident waiting for a timestamp.
• Treat Gateway credentials as operator secrets. Gateway HTTP bearer credentials are effectively full-access operator secrets for that Gateway. Store them like passwords to your most important account, because functionally they are.
• Keep the Gateway private. The docs advise keeping trustedProxies tight and avoiding direct public exposure of the Gateway. If you cannot explain why your Gateway needs to be reachable from the internet, it does not.
• Define origins deliberately. The docs warn against wildcard allowedOrigins outside tightly controlled local testing.

Then add the human layer. Create approval gates for external sends, payment actions, record updates, admin changes, data deletion, file writes, and first runs of any new skill. Log the approvals. Every sensitive action should have an owner, a reason, a timestamp, and a rollback plan. This sounds heavy. In practice it is one confirmation tap in your chat channel, and it is the difference between an agent you supervise and an agent you hope behaves.

Post-install verification checklist#

The most common mistake is stopping when the CLI works. A CLI that runs is not a system you can trust. Run this sequence before you hand the agent anything real.

If every step passes, you have a working, restart-proof, gated agent. If a step fails, the next section covers the usual suspects.

Common OpenClaw setup mistakes and how to avoid them#

Nearly every failed first hour lands in one of seven buckets. Diagnose by symptom and you will fix most of them in minutes.

One habit prevents most of this: change one variable at a time. Install, verify. Add a channel, verify. Add a skill, verify. When something breaks, you will know exactly what broke it.

Realistic OpenClaw install time: DIY vs ClearSetup#

Honest numbers, because the 5 minute figure gets quoted without context. The official quickstart really can run in about 5 minutes when Node, your API key, permissions, and a simple channel are ready. That gets you a working demo. It does not get you a hardened system you would connect to your business.

If you have the hour and enjoy the work, the DIY path above is complete. Nothing is held back. The decision is not about ability. It is about whether your time is better spent building the workflows that use the agent or operating the installer. If you want the outcome without the afternoon, ClearSetup will install OpenClaw on a private VPS or locally on a machine you own, configure your channels and skills, harden the Gateway, set up your approval gate policy, and hand you a verified, documented system.

What to automate after the setup works#

A verified install is the starting line. The best first workflows are low-risk and high-frequency: morning summaries, reminders, drafts, inbox triage, research digests, and status updates. Keep the approval gates on anything that sends externally, touches customer records, or moves money. For the full picture of what a working agent can do for an owner, read The Ultimate OpenClaw Guide for Business Owners. When you are ready to pick your first workflow, use What to Automate First With OpenClaw, and then borrow from 25 OpenClaw Automations That Save Time Every Week for tested, copy-ready workflows. If you want to understand every layer you just installed, our guide on how to build an AI agent walks through the full stack from model to approval gates.

node -v

curl -fsSL https://openclaw.ai/install.sh | bash

iwr -useb https://openclaw.ai/install.ps1 | iex

npm install -g openclaw@latest

openclaw onboard --install-daemon

openclaw channels add --channel telegram --token YOUR_BOT_TOKEN

openclaw gateway status

openclaw dashboard

Frequently asked questions#