Pebellslearn by building
0%
RoadmapsMatrixCoursesSandboxSign in
Installing and Onboarding  ›  Capstone Project

Gateway Settings and the Daemon

Gateway Settings 12 minSet the Gateway's port, bind it to localhost, protect it with a long random token, and install it as a daemon so it starts on boot and survives logouts, restarting and auditing after every change.

Gateway Settings and the Daemon

Your agent answers, but only while the terminal you started it from stays open. Close that window or reboot, and the agent is gone. The last onboarding steps fix this safely: settle the Gateway's network settings, then hand the Gateway to a daemon that keeps it running.

The rule

Bind narrow, lock with a token, and let a daemon keep it running.

Gateway settings decide how the server behaves on the network:

  • Port. The single port the Gateway listens on. Control connections, HTTP, the Control UI and hooks all share it.
  • Bind address. Which network interface it listens on. localhost (also written 127.0.0.1) means only programs on this machine can connect. 0.0.0.0 means every network interface, which can mean the whole internet.
  • Auth token. The password every client must present. Make it long, random and unique; never share it or commit it to version control.

The daemon. A daemon is a background process that runs without any terminal window. When the Gateway is installed as a daemon, which the onboarding wizard offers to do, it starts automatically when the machine boots and keeps running after you log out. That also matters for the proactive core: heartbeats and cron jobs can only fire while the Gateway runs.

The gateway commands control it:

openclaw gateway start     # start the Gateway
openclaw gateway stop      # stop it
openclaw gateway restart   # restart it, for example after a config change

The shortcut

After any settings change: restart, then audit. openclaw gateway restart loads the new settings, and openclaw security audit --deep checks that the change did not open a hole.

Getting a new server ready to leave aloneStep 1 of 4

  1. Check the bind address

    The settings say localhost. Good: leave it there.

The trap is fixing reachability by switching to 0.0.0.0. It works, and it also invites every network the machine is on. Keep localhost and use Tailscale, an SSH tunnel or a reverse proxy.

Drills

Answer fast — trust the rule.

quick drill

What does binding the Gateway to 0.0.0.0 mean?

quick drill

What does running the Gateway as a daemon give you?

quick drill

You changed the Gateway's port. What should you do next?

quick drill

Which of these is the best Gateway auth token?

Remember

  • Bind narrow, lock with a token, and let a daemon keep it running.
  • After any settings change: restart, then audit.
  • Trap: 0.0.0.0 and weak tokens, and a Gateway that dies with its terminal.

Practice — level up

0/1 solved

Write your answer, then compare it with a rubric and a model answer.

ExplainReady to walk away

Before leaving a new OpenClaw server running on its own, explain which Gateway settings you would check, why you would install the daemon, and what you would do after changing any setting.