Security Configuration in OpenClaw
From the OpenClaw cheat sheet · Security & Access · verified Jul 2026
Security Configuration
Secure your Gateway with auth, allowlists, and remote access
json5
# Set loopback binding (local only)
openclaw config set gateway.bind loopback
# Enable token auth
openclaw config set gateway.auth.mode token
# Generate a secure gateway token
openclaw doctor --generate-gateway-token
# Set gateway mode
openclaw config set gateway.mode "local"💡 Set gateway.bind to "loopback" to only accept local connections
⚡ Use "openclaw doctor --generate-gateway-token" to create a secure random token
📌 Without dmPolicy: "allowlist", anyone who finds your bot can pair and get full access
🟢 For remote access, use Tailscale instead of exposing the gateway port directly