Security

Security best practices for OpenClaw.

Overview

Security considerations for running OpenClaw:

• Authentication
• Network security
• Data protection
• Sandboxing

Authentication

Always enable authentication:

{
  gateway: {
    auth: {
      enabled: true,
      apiKey: "strong-random-key"
    }
  }
}

Network Security

Local Only (Default)

By default, the gateway only accepts local connections:

{
  gateway: {
    host: "127.0.0.1"
  }
}

With Remote Access

If exposing to the internet:

1. Use a reverse proxy (nginx, Caddy)
2. Enable HTTPS
3. Use strong authentication
4. Consider IP whitelisting

API Key Security

• Store API keys securely
• Don't commit to version control
• Use environment variables

export ANTHROPIC_API_KEY="sk-ant-..."

Sandboxing

Enable sandboxing for code execution:

{
  tools: {
    "code-execution": {
      sandbox: true,
      timeout: 30000
    }
  }
}

Data Protection

• Sensitive data encrypted at rest
• Sessions can be cleared automatically
• Memory can be selectively deleted

Security Checklist

• [ ] Authentication enabled
• [ ] API keys stored securely
• [ ] Gateway bound to localhost (or behind proxy)
• [ ] HTTPS enabled for remote access
• [ ] Sandboxing enabled for code execution
• [ ] Regular updates installed

See Also

• Authentication
• Sandboxing
• Remote Access