Choose a Plan
OpenClaw’s official VPS guidance lists an absolute minimum of 1 vCPU, 1 GB RAM, and about 500 MB of free disk. It recommends 1–2 vCPU and 2 GB or more of RAM for logs, media, and multiple channels.
Choose an Ubuntu LTS image. Browser data, sessions, media, logs, skills, and backups require more than the base installation size, so monitor memory and disk usage as the workload grows. Review current availability and pricing on the Arct Cloud pricing page.
Before You Begin
Prepare the following:- An SSH key and the public IP address from which you administer the VPS
- Credentials for the model provider selected during onboarding
- A model-usage budget and provider-side spending alerts
- Protected off-server storage for OpenClaw backups
- Optionally, a Telegram bot token from BotFather
Install OpenClaw
1
Deploy and Connect
2
Restrict Inbound Access
A baseline OpenClaw deployment needs only SSH inbound. Configure the firewall protecting the VPS before installation:
Attach and verify a network-level firewall or ACL before installation. Keep the current session open and test SSH from a second terminal before disconnecting. Do not add inbound rules for
18789, 80, or 443; the Gateway, model providers, and messaging channels use outbound connections for this setup.3
Run the Official Installer
Install OpenClaw with its official Linux installer:The installer also provisions a supported Node.js runtime when required. After installation, run the canonical onboarding flow and install the managed service:Select your model provider and enter its credentials. Onboarding generates Gateway token authentication by default. Model usage is not included with the VPS.On Linux, this installs a user-level systemd service. Onboarding attempts to enable lingering so it survives logout; verify it after setup:If the result is
Linger=no, run sudo loginctl enable-linger "$USER", then restart and recheck the Gateway.4
Keep the Gateway Private
Retain the default loopback bind, token authentication, and port
18789. These settings make the Gateway reachable only from the VPS itself:5
Open the Control UI Through SSH
On your local computer, create a tunnel to the loopback-only Gateway:Keep that terminal open, then visit
http://127.0.0.1:18789/ in your local browser and authenticate with the token created during onboarding. Close the tunnel with Ctrl+C when finished.6
Add Telegram (Optional)
Add the bot from a trusted SSH session:Keep the default DM pairing policy and group allowlist. Do not switch DMs to public access or add a wildcard sender. When your account receives a pairing code, approve only the expected identity:Treat the bot token as a secret and rotate it if it is exposed.
7
Verify the Deployment
Confirm that the service answers authenticated RPC calls, then run health and security checks:Resolve security-audit findings before granting additional tools, installing third-party skills, or connecting more users.
Security Model
OpenClaw’s supported posture is one user or trust boundary per Gateway. Anyone allowed to message a tool-enabled agent may be able to steer the same permissions, files, browser sessions, and credentials. Separate unrelated users or teams onto separate gateways and VPS instances. Pairing and allowlists control who can trigger the agent, but they do not eliminate prompt injection. Web pages, messages, documents, attachments, and tool output can all contain hostile instructions. Keep sensitive files outside the agent workspace, disable browser, network, filesystem, and command tools unless required, use sandboxing and approval rules, and review third-party skills and plugins as executable code. See the official OpenClaw security guidance.Back Up State
OpenClaw state can include provider credentials, channel tokens, sessions, and workspaces. Create a verified archive, protect it like the live VPS, and copy it to encrypted off-server storage:openclaw backup verify ARCHIVE and rehearse recovery on an isolated host. A backup left only on the VPS does not protect against server loss.
Update Safely
Create a verified backup before a significant update, then update and recheck the service:Troubleshooting
Official Resources
OpenClaw Documentation
Current installation, Gateway, channel, security, backup, and update guidance.
OpenClaw on GitHub
Source code, releases, security policy, and issue tracker.
OpenClaw is developed by the OpenClaw project. Arct Cloud is an independent hosting provider and is not affiliated with, sponsored by, or endorsed by OpenClaw.