Application catalogue
OpenClaw
An open source assistant whose gateway Cloud finishes setting up after the first deploy.
Updated
OpenClaw is an open source assistant that connects to WhatsApp, Telegram and Discord and is driven from its own control page. Cloud creates it from the catalogue with its storage in place, then finishes its setup after the first deploy. Its own documentation is at docs.openclaw.ai, external link.
| Setting | Value |
|---|---|
| Image | ghcr.io/openclaw/openclaw:2026.9.5 |
| Port | 18789, the gateway |
| Volume | State, at /home/node/.openclaw |
| Smallest size | Small |
| Values you are asked for | OpenRouter key, optional |
Set it up
Create it
On a project, press Add a service, then Create on OpenClaw under Services. Paste an OpenRouter key if you have one: the form notes that "The assistant answers nothing without one", and you can add it later. Press Create service.
Deploy
Press Deploy. The first container runs a holding command that serves nothing on any port, because the gateway cannot start until its password file exists.
Let Cloud finish setup
Once the deployment is Done and a container is running, Cloud writes two files into it, switches the service to OpenClaw's own command and restarts it. The gateway then starts with its password already in place. The Command card on the Overview shows the new command once setup has run.
Sign in
On the Environment section, press Edit, copy
OPENCLAW_GATEWAY_PASSWORDand press Cancel. Once the domain reads HTTPS active, press Visit and sign in to the gateway with the password. There is no user name.
The gateway never starts without its password
Before setup finishes, nothing listens. After it, the gateway starts only with its password file already written.
What setup writes
| File | What it holds |
|---|---|
/home/node/.openclaw/openclaw.json | Gateway settings that trust the platform's proxy network, without which OpenClaw refuses requests that come through it |
/home/node/.openclaw/gateway-password | The gateway password, copied from OPENCLAW_GATEWAY_PASSWORD |
Both files are on the State volume, so they survive deploys. The password is generated once, 24 random letters and digits, and saved in the service's environment. The file is written from that value rather than a new one, so a retried setup never hands you a password other than the one the Environment section shows.
OpenClaw rewrites its settings file while it runs, by renaming a new copy over the old one, which is why a .bak and a .last-good file appear beside it.
Changing the variable does not change the password
OpenClaw reads its password from the file, not from the variable, and setup writes the file only once. Editing OPENCLAW_GATEWAY_PASSWORD after setup has finished does not change the password the gateway checks.
If setup does not finish
The service's Overview shows Setup did not finish with one of these sentences:
"Cloud could not finish setting this application up. Try again." Cloud could not write the files. The same sentence appears when
OPENCLAW_GATEWAY_PASSWORDwas removed or emptied before setup ran, since Cloud never writes an empty password; put the variable back first."Cloud could not finish setting this application up: it is not running, so there is nothing to write its files into. Start the service, then try again." The deployment finished but no container was running.
Press Try again to repeat it. Once setup has succeeded it does not run again. Catalogue setup did not finish covers both cases.
Why the start command has no shell
OpenClaw's command is a flat list of flags with no quotes, pipes or &&, because Cloud runs a start command without a shell. Build settings explains the rule.
node /app/openclaw.mjs gateway --port 18789 --allow-unconfigured --auth password --password-file /home/node/.openclaw/gateway-passwordIts data
OpenClaw keeps its state under /home/node/.openclaw, on the State volume. The automatic backup of that volume is an archive, taken while the gateway is stopped; Backups covers what an archive can and cannot do today.