By Jacob Cox

OpenClaw calls itself “The AI that really does things”, and the project has more than 390,000 GitHub stars. One Gateway connects the model of your choice to chat apps such as Telegram, Slack, Discord and WhatsApp, and gives it a shell, files, a headless browser, scheduled jobs, memory and MCP servers. The hard part is running an agent with a shell safely: long-lived state, bot tokens that must stay secret, and an endpoint you do not want on the internet by accident. On Control Plane, OpenClaw is one install from the Template Catalog, Control Plane’s library of ready-to-install apps, from the Console, CLI, Terraform or Pulumi. It has no public endpoint by default, reads its keys from a secret you create, and comes with the Control Plane MCP server registered, so after you sign in the agent can manage your Control Plane resources from chat.

Why self-host OpenClaw on Control Plane

  • One install. No manifests and no wiring. The Gateway, its storage, its identity and its browser come up together with secure defaults.
  • Secrets kept out of config. Your gateway token, model key and bot tokens live in one Control Plane secret you create. The workload reads them by reference, so none of them appear in Helm values or your install command.
  • Least privilege, created for you. The workload’s Control Plane identity can read your secret and its own first-boot config (the Gateway’s initial settings file), and nothing else. Signing in to the Control Plane MCP server is a separate, explicit step.
  • Private by default. No public endpoint until you ask for one. Telegram, Slack, Discord and WhatsApp all connect outbound, so they work on a private install.
  • Control Plane from chat. The Control Plane MCP server exposes the Control Plane API as tools an AI agent can call. It is pre-registered and does nothing until someone signs in, and after sign-in the agent can do what that account can do.
  • Snapshots included. State sits on a volume with daily snapshots, with no bucket or backup job to set up.

Included out of the box

  • Any model you bring: Anthropic, OpenAI, or any OpenAI-compatible endpoint such as OpenRouter or a LiteLLM gateway
  • Headless Chromium for the agent’s browser tool (can be turned off)
  • The built-in Control UI for configuring and watching the agent
  • A 10 GiB volume for config, sessions, plugins, workspace and memory, which can grow automatically (off by default)
  • Daily snapshots at 03:00 UTC, kept for 7 days (schedule and retention are configurable)
  • An optional OpenAI-compatible HTTP API
  • Built-in Control Plane logs and metrics, plus Control Plane’s tamper-proof audit trail of platform actions

How to run OpenClaw securely without a public URL

The Gateway accepts no traffic from the internet until you turn it on, and by default only workloads in the same Global Virtual Cloud (GVC), Control Plane’s term for a set of locations a workload runs across, can reach it. Traffic between workloads uses mTLS. For setup you reach the Control UI with cpln port-forward from the Control Plane CLI, and you turn on public access, optionally on a custom domain, only when you want it. Apps in the same GVC reach the optional HTTP API over internal DNS by sending the gateway token, which is a full-admin credential, as a bearer token, plus an X-Forwarded-For header with a non-loopback address. Because the chat channels dial out, you can run a Slack or Telegram assistant with no public URL at all.

If you turn on public access, the gateway token guards the agent from the internet. Each new browser also needs a one-time approval from the CLI, but the HTTP API, if you enable it, accepts the token alone, so keep the token long and random.

Control Plane isolates each workload with cgroups, namespaces, and restricted syscalls and capabilities. The agent’s shell runs inside the Gateway’s own container, with the Gateway’s access: its volume, its keys and the workload’s Control Plane token, which can only reveal the two secrets the template grants. Outbound traffic is open so the Gateway can reach your model and chat apps. Like any agent with a shell, OpenClaw can be steered by an approved contact, a web page it reads or a third-party skill, so give it only the access you would give those sources.

Where OpenClaw’s API keys and bot tokens live

You create one Control Plane dictionary secret, a secret that holds named key-value pairs, with a gateway-token (your Control UI login, at least 24 characters), an llm-api-key, and the bot tokens for each channel you enable (WhatsApp needs none). The template creates a policy that lets the workload’s identity reveal exactly that secret and the first-boot config, which holds no credentials. The Gateway, and so the agent’s shell, can read these values at runtime, so use a model key with a spend limit and bot tokens you can revoke. OpenClaw also runs a heartbeat turn every 30 minutes by default, so it spends some model tokens even when nobody messages it.

To rotate a key, export the secret with cpln secret reveal SECRET_NAME -o yaml, edit it, re-apply it with cpln apply -f, and delete the exported file, which holds your keys in plain text. Then run cpln workload force-redeployment to load the new values. Because OpenClaw runs a single Gateway, the redeployment takes the assistant offline for about 4 minutes, so rotate during a quiet window. If a token leaks, revoke it with the provider too, because changing the secret does not invalidate the old token.

Manage Control Plane from your chat apps

With cplnMcp.enabled (the default), the Control Plane MCP server is registered as cpln. In the default shared mode, you sign in once from a terminal and approved chat contacts act through that account, so sign in with a dedicated Control Plane user whose policies grant only what the assistant needs, or set cplnMcp.enabled to false. Control Plane actions taken through the MCP server are recorded in the audit trail under that user. In per-requester mode, which needs public access, each person signs in with their own Control Plane account from a chat link. Once signed in, you can ask the assistant to list your GVCs, inspect a workload or check a deployment.

State that survives

Pairings, the WhatsApp link, MCP sign-ins, sessions and memory live on the volume, and the platform snapshots it on a schedule. The Gateway runs as one replica by design, because OpenClaw supports one Gateway per state directory and each bot token holds only one connection. For a separate assistant per person or team, install the template again under a different release name, with its own secret and bot tokens. Control Plane encrypts volumes by default; snapshots still hold channel sessions and tokens, so limit who can restore them. Uninstalling deletes the volume and all state, so copy out anything you need first.

How to deploy OpenClaw on Control Plane

Sign up for Control Plane, then work in this order. First, create the dictionary secret described above, in the Console or with cpln secret create-dictionary, using openssl rand -hex 32 for the gateway token. It must exist before you install: an install that points at a missing secret reports success but never starts. Second, pick an existing GVC with a single location, because the template does not create one and each extra location would run its own assistant competing for the same bot tokens. Third, install OpenClaw from the Template Catalog in the Console, or with cpln helm install, setting secret.name to your secret’s name. Open the Control UI with cpln port-forward and sign in with the gateway-token value.

To connect a chat app, add its bot token to the secret first (WhatsApp needs none), then enable the channel with cpln helm upgrade, repeating every value you installed with, including secret.name, because an upgrade does not keep values you leave out. DM your bot, approve the pairing code it replies with using cpln workload exec, then DM it again, and the reply comes from your model. Approve only contacts you would trust as admins, because an approved contact can have the agent run shell commands in the Gateway’s container. To hold each command for your approval, set tools.exec.ask to always.

The OpenClaw template documentation has the exact commands, bot setup for each channel, the custom domain, the HTTP API and troubleshooting. Running agents for a team or across your company? Request a demo.

FAQ

These answers cover running OpenClaw with the Control Plane template.

What is OpenClaw?

OpenClaw is an open source, self-hosted AI assistant you chat with in apps such as WhatsApp, Telegram, Slack, Discord, iMessage and Teams. It can run shell commands, browse the web, edit files and run scheduled jobs with the model you choose. The Control Plane template connects Telegram, Slack, Discord and WhatsApp.

How do I self-host OpenClaw?

Create a dictionary secret with a gateway token and your model key, then install OpenClaw from the Control Plane Template Catalog into an existing single-location GVC, from the Console or with cpln helm install, setting secret.name to that secret. The template creates the Gateway workload, its volume, identity and access policy, and keeps it private by default.

What resources does OpenClaw need on Control Plane?

The template reserves 500 millicores of CPU and 1 GiB of memory by default, with limits of 2 cores and 3 GiB, plus a 10 GiB volume. With the browser tool turned off, a 2 GiB memory limit is enough. You pay for the CPU and memory a workload reserves, with no contracts or minimums.

How do I run OpenClaw securely?

Keep the Gateway off the public internet and keep its keys in a secret the workload reads by reference, which the Control Plane template does by default. Then approve pairings only for trusted contacts, vet third-party skills before installing them, and sign in the Control Plane MCP server with a limited-permission user or disable it. To approve each shell command yourself, set tools.exec.ask to always. Like any agent with a shell, OpenClaw can be steered by an approved contact or by a page it reads, so these limits matter.

Does OpenClaw on Control Plane need a public URL?

No. The install is private by default, you reach the Control UI with cpln port-forward, and all four chat channels in the template, including WhatsApp, connect outbound. Turn on public access, optionally on a custom domain, when you want the Control UI on the web for daily use, the HTTP API for callers outside Control Plane, or each chat user signed in to Control Plane with their own account.

Where are OpenClaw’s API keys and bot tokens stored?

In one Control Plane dictionary secret that you create before installing. The workload reads the values by reference at startup, through a policy created by the template that grants its identity access to that secret and the first-boot config only.

Can I run OpenClaw in more than one location?

Run it in one location. A workload runs in every location of its GVC, so each extra location would start its own assistant, and they would compete for the same bot tokens. Pick a GVC with a single location, and install the template again under a different release name, with its own secret and bot tokens, for more assistants.

How is OpenClaw’s state backed up?

All state, including pairings, the WhatsApp link, MCP sign-ins, sessions and memory, lives on a volume (10 GiB to start) that the platform snapshots daily at 03:00 UTC and keeps for 7 days by default. No bucket or cloud account is needed. Restoring a snapshot reverts the volume in place, so anything written after it, including newer pairings, is lost, and uninstalling deletes the volume.

Which models can OpenClaw use on Control Plane?

Any model you bring a key for: Anthropic, OpenAI, or any OpenAI-compatible endpoint such as OpenRouter or a LiteLLM gateway. You set the provider and bare model ID as template values, plus a base URL for an OpenAI-compatible endpoint. The default is Anthropic’s Claude Opus 5.5.

What can someone who messages my OpenClaw bot do?

Nothing until you approve them: a new contact gets a pairing code, and the agent does not process their messages until you approve it. An approved contact can use everything the agent can, including shell commands in its container, the browser, the keys it can read, and, if the Control Plane MCP server is signed in, that account’s permissions. Approve only people you would trust as admins.

Originally published on the Control Plane blog.