The Complete OpenClaw Guide: Setup, Skills, and Running in Production

Step 4: Connect Communication Channels

Telegram (Recommended for Beginners)

The official documentation recommends Telegram as the best beginner-friendly channel. OpenClaw can walk you through the setup steps, including messaging the @BotFather to create a bot token. Once connected, you can message your bot on Telegram and it works immediately as a capable assistant.

WhatsApp

WhatsApp integration uses the Baileys library. The official documentation notes that you need to set up an allowlist to restrict interaction to specific contacts. Community members report success using a Tello eSIM to give the agent its own phone number.

Other Channels

OpenClaw supports over 20 messaging channels out of the box: Discord, Signal, iMessage, Slack, IRC, Microsoft Teams, LINE, Matrix, Nostr, and more. Each channel is configured in the channels section of openclaw.json.

Step 5: Set Up Persistent Memory

GitHub Sync

Community members recommend syncing your workspace to a private GitHub repository. Every night at 11 PM, a cron job pushes everything to the repo. Every time the agent updates a file during the day, it commits and pushes too. This gives you version control, diff capability, and portability.

Memory in Practice

One community member reports that their agent's MEMORY.md grew into a genuine knowledge base containing preferred approaches, learned pitfalls (like LinkedIn's per-post identity switching), account credentials references, and project context. Daily memory files capture every significant decision and interaction. When the agent starts a new session, it reads yesterday's and today's notes plus its long-term memory. The result is that conversations feel continuous even though every session is technically fresh.

Step 6: Activate the Heartbeat

The heartbeat is a periodic poll (typically every 30 minutes) where the agent checks a HEARTBEAT.md file for pending tasks. Multiple checks get batched together (check email, review calendar, monitor a service) in one turn. Heartbeats are cheaper and more flexible than cron jobs but less precise in timing.

To configure the heartbeat interval, edit the heartbeat section in openclaw.json. The official documentation notes that with Anthropic OAuth, the default interval is every hour.

Step 7: Schedule Tasks with Cron Jobs

Cron jobs execute at precise times. They run in isolated sessions with their own model configuration. To list scheduled cron jobs:

openclaw cron list

To add a cron job, edit the cron section in openclaw.json. Each cron job specifies a schedule (using standard cron syntax), a task description, and optionally a different model to use.

Step 8: Lock Down Security

Essential Security (10 minutes)

The official documentation provides these essential security steps:

1. Lock down the Gateway. Bind it to localhost only. Never expose it to the open internet. Use SSH tunneling to access it remotely. The command for SSH tunneling is:

ssh -L 18789:127.0.0.1:18789 user@your-vps

2. Rotate your gateway auth token. Use a strong random string. Store it in your .env file, not hardcoded in config.

3. Run on a dedicated computer. Do not install OpenClaw on a work or personal computer that is actively in use. OpenClaw can technically have access to all files on the computer it runs on. The community recommends using an isolated box: a dedicated Mac Mini, a VPS, or an old laptop.

4. Give the agent its own credentials. Create a dedicated Gmail address for your agent. Give it read access to your main account and write access to select files only.

5. Never share your bot with anyone else. Do not add it to group chats or websites. Restrict interaction to yourself via an allowlist.

Advanced Security (Optional)

Docker-based sandboxing. The official documentation and community guides recommend running OpenClaw in Docker for additional isolation. Here is a production Docker Compose configuration from the community:

services:
  openclaw:
    image: ghcr.io/hostinger/hvps-openclaw:latest
    init: true
    entrypoint:
      - /bin/bash
      - -c
      - |
        find /data/.openclaw/browser -name SingletonLock -delete 2>/dev/null
        (
          sleep 15 \
          && GOLDEN_CFG=/data/.openclaw/config-backups/openclaw.json.golden \
          && [ -f "$$GOLDEN_CFG" ] \
          && cp "$$GOLDEN_CFG" /data/.openclaw/openclaw.json \
          && echo '[config-guard] Restored golden config after startup'
        ) &
        exec /entrypoint.sh node /server.cjs
    ports:
      - "127.0.0.1:${PORT}:${PORT}"
    env_file:
      - .env
    restart: unless-stopped
    volumes:
      - ./data:/data
      - ./data/linuxbrew:/home/linuxbrew
      - /dev/shm:/dev/shm
    shm_size: '2gb'
    cap_add:
      - SYS_ADMIN
    security_opt:
      - seccomp:unconfined

This configuration does several things. It deletes stale Chrome SingletonLock files before start (Chromium leaves these behind on unclean shutdown, which blocks the managed browser from launching). It restores a golden config after startup (OpenClaw rewrites openclaw.json on startup and can strip custom settings). It binds to localhost only (external access is via SSH tunnel or Tailscale). It sets shared memory to 2GB (required for Chromium in Docker; without this, Chrome tabs crash with out-of-memory errors). It adds SYS_ADMIN capability (required for Chromium's sandboxing within Docker) and disables seccomp filtering (Chromium uses syscalls that Docker's default seccomp profile blocks).

Config guard script. Community members have created a config guard script that validates openclaw.json has all required custom settings after startup. This catches regressions where OpenClaw silently drops settings during startup, doctor runs, or wizard runs.

Environment variables are visible. If you are running a multi-agent setup and one agent has shell access, it can read your environment variables (API keys, passwords, everything). Never assume a prompt (system instructions) is a security wall. Use hard tool restrictions to prevent agents from reading each other's .env files.

Three Tiers of Deployment

Community members categorize deployments into three tiers:

• Tier 1 (Personal use, single machine): Never give the agent sudo access or expose it to the open internet without a tunnel.
• Tier 2 (Multi-agent, shared machine): Never assume a prompt is a security wall. Use hard tool restrictions to prevent agents from reading each other's .env files.
• Tier 3 (Production, business use): Never link personal tools (Calendar/Email). Treat this agent as a stranger with a script.

Step 9: Enable Web Search and External Tools

Web Search

During onboarding, you can set up web search. This gives your agent access to the internet. You can skip this and set it up later when you need it.

Browser Automation

OpenClaw includes a built-in browser control server that lets your agent operate a real Chrome browser via CDP (Chrome DevTools Protocol). It can navigate pages, click buttons, fill forms, take screenshots, and extract content. This is not a headless scraper. It is a full browser that can handle JavaScript-heavy sites, login sessions, and multi-step workflows.

MCP Tool Integration

The Model Context Protocol (MCP) lets your agent connect to external tool servers. One community member reports running 134 MCP tools through their setup, covering CMS management, image generation, social media publishing, and more. MCP tools are defined by external servers, and OpenClaw discovers and connects to them automatically.

Step 10: Build Your Use Cases

Personal Assistant

Start with a personal assistant. Share your name, role, and common admin challenges (scheduling, remembering tasks, coordination with family). The agent writes this down in its workspace files and uses it to build its identity and operating system.

Daily Content Pipeline

One community member's agent publishes blog posts in four languages daily. The workflow includes research, writing, translation, SEO keyword generation, CMS publishing, image generation, URL verification, Google Search Console submission, and social media posting. This entire pipeline runs with a single instruction.

Social Media Automation

Agents can handle social media presence across X, LinkedIn, and Facebook. Using browser automation, agents can log into LinkedIn, navigate to relevant posts, and engage as a company page (liking, commenting, building visibility).

Video Shorts Pipeline

One complex workflow turns blog posts into short-form video content using Veo 3.1 for scene generation, ElevenLabs for voice synthesis, automated captioning, lip sync via Sync Labs, and final assembly with crossfade, reverb, and ambient audio. The agent orchestrates 20+ MCP tools to make this happen.

Proactive Monitoring

Via heartbeats, agents periodically check infrastructure: are websites up? Any urgent emails? Upcoming calendar events? The agent logs check timestamps and only alerts when something needs attention.

Troubleshooting

Gateway Fails to Start

If you see Gateway failed to start: gateway already running and Port 18789 is already in use, the gateway is already running as a systemd service. Do not try to start a second instance. Use openclaw health to confirm it is working, or openclaw gateway restart if you need to pick up config changes.

Browser Crashes in Docker

If you are running the browser inside Docker and it crashes silently or behaves erratically, you need shm_size: '2gb' and /dev/shm mounted. This is not optional. It is a hard requirement.

Stale Chrome SingletonLock Files

If your agent cannot launch the browser after a restart, Chrome left SingletonLock files from an unclean shutdown. Add a cleanup step to your Docker entrypoint:

find /data/.openclaw/browser -name SingletonLock -delete 2>/dev/null

Config Gets Overwritten on Startup

OpenClaw rewrites openclaw.json on startup, during openclaw doctor, and when the wizard runs. Each time, it can silently drop settings it does not own (particularly the number from channels.whatsapp.allowFrom, agent bindings, and token values). The community solution is a config guard script that validates the config after startup and restores a known-good golden copy if needed.

Token Limits and Agent Loops

Debugging token limits, agent loops, corrupted configs, and permission issues can burn time and money. The official documentation recommends creating a dedicated Claude or ChatGPT project pre-loaded with OpenClaw's docs. When something breaks, copy the full error output (5-10 lines of context) and paste it into the project along with what you were doing and the relevant section of openclaw.json.

Going Further

Once your agent is running, explore these next steps drawn from the source material:

• Install skills from ClawHub. Run openclaw skill install to browse the marketplace. The official documentation recommends starting with the gog skill (for Gmail, Google Calendar, and Docs access) and the summarize skill.
• Enable hooks. These are tools that keep your setup optimized. Session memory is the most important. The others help when you want to debug or optimize your agent.
• Explore multi-agent routing. OpenClaw supports multiple agents in one installation. You can route messages to different agents based on the channel, the user, or the content. Agents can also spawn sub-agents for specific tasks.
• Build custom skills. The skill format is portable and compatible with Claude Code and Cursor conventions. If a skill does not exist, you can describe the task to your agent and have it draft one.
• Set up voice replies. Ask your agent for options. One community member found free voices in Microsoft's Edge TTS service and gave their agent a British voice.
• Join the community. The official documentation points to the GitHub repository, ClawHub, and community forums for ongoing learning and support.