iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenClaw, NVMe storage and a 14-day free trial.
After OpenClaw’s initial setup, make the Gateway persistent, verify it locally, connect one channel, and lock down who can send messages. Then review the workspace files, choose heartbeat behavior, add capabilities incrementally, create a private backup, and decide whether the Gateway belongs on your laptop, a home server, or a VPS.
The practical sequence is: install the background service, confirm port 18789 and the dashboard, pair or allowlist one private channel, secure the workspace, and only then add automation. This order prevents a working chat connection from being mistaken for a secure deployment.
1. Keep the Gateway running after you close the terminal
The quick-start process runs the Gateway in the foreground. Closing that terminal, signing out, or stopping the process therefore stops the agent. Convert it to an operating-system service before configuring channels or automations.
Install the service
- Stop the foreground Gateway with
Ctrl-Cin the terminal where it is running. - Run
openclaw gateway install. - OpenClaw installs a LaunchAgent on macOS, a systemd user unit on Linux and WSL2, or a Scheduled Task on native Windows.
- Check the result with
openclaw gateway status. A healthy Gateway should be listening on port18789, according to the current documentation. - Run
openclaw dashboardto open the browser Control UI. - Send a test message from the dashboard. Confirm that the request is accepted and that the agent returns a response before adding an external channel.
If the status command reports a stopped or failed unit, inspect the service output supplied by your operating system, confirm that the account running the service can read the OpenClaw configuration and workspace, and rerun the status check. Do not expose port 18789 directly to the public internet while diagnosing the service; first make the local dashboard work.
#1 Best Overall
- WHY CHOOSE G3 ULTRA MINI PC PENTIUM GOLD 7505 - Choose the Intel Pentium Gold 7505 for snappier everyday responsiveness: It delivers up to 30% faster single-core performance than the Ryzen 5 3500U, making office apps and web browsing feel noticeably quicker, while its Intel UHD Graphics (48 EUs) provides 2.4x the GPU performance of the N100 & N150's 24-EU graphics, ensuring smoother 4K streaming and light photo editing.
- 16GB RAM MEMORY & 512GB STORAGE - GMKtec Nucbox G3 Ultra mini computer is prebuilt with 16GB LPDDR4 RAM at 3200 MT/s, you will enjoy a speedier experience with Built-in 512GB M.2 SATA Hard Drive. Our mini desktop pc boots up in seconds, work on multiple browser tabs, software applications and quickly transfers files. There is a primary slot and secondary expansion storage. Primary slot is M.2 2280 PCIE and secondary slot is M.2 2280 SATA.
- RICH INTERFACE - Nucbox pentium mini computer is equipped with 3* USB 3.2 Gen2 ports, up to 10Gbps/S, 1*USB 2.0, HDMI(4K@60Hz)*2, 3.5mm Audio Jack. Supports WiFi 6, and Gigabit Ethernet RJ45 2.5GbE network connectivity, Bluetooth 5.2. This Mini PC supports multiple device connection and can be used with servers, monitoring equipment, office equipment, displays, projectors, televisions, etc.
- 4K DUAL SCREEN DISPLAY - Mini desktop computer is equipped with upgraded Intel Graphics(max 1000MHz), supports 4K video playback and AV1 decoding, connect the pc with a projector as a home theatre, enjoy a variety of entertainments. Two HDMI 2.0 ports allows you to multi-task efficiently on two 4K@60Hz displays.
- UPGRADED COOLING FAN - The G3 Ultra has upgraded the cooling fan to reduce fan noise and thermals. We are using an upgraded thermal paste as well to help reduce heat on the CPU.
What a successful first check proves
- The Gateway process can start under the service manager rather than only in an interactive shell.
- The local Control UI can reach the Gateway.
- The configured model and basic workspace path are usable.
It does not prove that an inbound channel is restricted. A dashboard response is an availability test, not an access-control test.
2. Add one channel, not all of them
OpenClaw supports Telegram, Discord, Slack, WhatsApp, Signal, iMessage, Google Chat, Microsoft Teams, Matrix, and additional plugin channels. Start with one channel and one private conversation. Multi-channel routing introduces more credentials, sender identities, permissions, and failure modes than a first installation needs.
Why Telegram is a practical first phone channel
The documentation describes Telegram as the fastest first phone channel because it requires a bot token. Create the bot and keep its token private, add the token through the channel configuration method for your OpenClaw release, then send a direct message to the bot from your own account. Verify that the message reaches the Gateway and that the reply returns to the same conversation.
Do not invite a group until the private exchange is reliable. A private test isolates authentication, routing, and response behavior; a group test also introduces mention rules, multiple senders, and accidental disclosure.
Use the same staged method for other channels
- Enable only the selected channel and supply its credential through OpenClaw’s documented configuration path.
- Start a private conversation from an account you control.
- Complete the channel’s pairing or approval step.
- Send a harmless test such as “reply with the channel name.”
- Check the Gateway logs and the channel conversation for one request and one response.
- Only after that test succeeds, add a second channel or a group.
Keep a short inventory of each channel’s credential, account, intended users, and allowlist. This makes later rotation and migration possible without guessing which token belongs to which integration.
3. Treat every inbound message as untrusted
OpenClaw’s project guidance states: “Treat inbound messages as untrusted input.” A message can contain instructions that are useful to the agent, irrelevant, or deliberately designed to make it reveal information or use a tool. The sender identity and the message content must therefore be handled separately.
Recommended Free Tools
Approve unknown senders deliberately
DM-capable channels pair unknown senders by default. The documented approval command is:
openclaw pairing approve <channel> <code>Replace the placeholders with the channel name and the pairing code shown by OpenClaw. Approve a request only when you recognize the sender and intend to give that account access. Keep a record of approved identities, especially when several channels are active.
Rank #2
- 12th Intel Alder Lake N95 Processor – The GMKtec G3 S Mini PC is powered by the 12th Gen Intel N95 processor with 4 cores, 4 threads, 6MB cache and a burst frequency up to 3.4GHz. Compared with N100/N5105/N5100/N5095, the N95 delivers up to 36% overall performance improvement. Perfect for routine tasks, office work, and home entertainment, this compact mini desktop is more convenient than traditional bulky PCs.
- 8GB RAM & 256GB SSD Storage – Pre-installed with 8GB DDR4 memory and a fast 256GB M.2 2242 SSD, the G3 S mini desktop offers quicker startup, smoother multitasking, and faster file transfers. Enjoy seamless performance whether you’re working on multiple applications, browsing, or streaming content.
- Rich Interfaces & Connectivity – The G3 S mini computer comes equipped with USB 3.2 (up to 10Gbps), dual HDMI 2.0 (4K@60Hz), and a 3.5mm audio jack. With support for WiFi 5, Bluetooth 5.0, and Gigabit Ethernet (RJ45 1000MbE), it connects easily with monitors, projectors, printers, office equipment, and other peripherals, making it versatile for both home and business use.
- Dual 4K Display Support – Featuring upgraded Intel UHD Graphics (up to 1000MHz), the G3 S supports 4K video playback and AV1 decoding for a smooth viewing experience. With dual HDMI outputs, you can connect two 4K@60Hz displays simultaneously, enabling efficient multitasking for work and entertainment.
- GMKTEC WARRANTY - GMKtec offers a 3-year limited warranty (1 year replacement + 2 years parts replacement) for each mini PC, starting from the date of the purchase effective on all sales starting Oct. 2026. All defects due to design and workmanship are covered. With a professional after sales team always ready to attend to your needs, you can simply relax and enjoy your mini PC
Use allowlists before adding people
Pairing is the initial gate; channel allowlists are the durable policy. Define which account IDs, phone numbers, or handles may contact the agent, using the identity format required by that channel. Recheck the list after changing accounts or migrating hosts.
For WhatsApp, the official personal-assistant guidance is explicit: “Always set channels.whatsapp.allowFrom (never run open-to-the-world on your personal Mac).” Configure that setting before connecting a personal WhatsApp account. The same principle applies to every DM-capable channel: do not leave an installation open to arbitrary senders simply because the first test worked.
Free tools Windows power users keep installed
One-click scans. No signup required.
Separate access tests from capability tests
- First test that an approved sender can receive a basic text response.
- Then test that an unapproved sender is rejected or remains in the pairing state.
- Only after both outcomes are correct should you expose browser, shell, file, webhook, or automation tools.
If an unknown account receives a response, stop the channel, correct the pairing or allowlist policy, and rotate the channel credential if it may have been exposed.
4. Understand the workspace contract
The default workspace is ~/.openclaw/workspace. Onboarding or the first agent run creates several instruction and identity files there. They are not disposable samples: they shape how the agent behaves on every later turn.
| File | Purpose | What to do after setup |
|---|---|---|
AGENTS.md |
Workspace-specific operating instructions and tool notes | Replace starter text with the rules, paths, approval requirements, and environment details that actually apply to this host. |
SOUL.md |
Behavioral guidance for the agent | Review tone, boundaries, and prohibited actions; remove assumptions that do not fit your use. |
IDENTITY.md |
Agent identity information | Set the name and role you want the agent to present consistently. |
USER.md |
Information about the person or team being assisted | Keep only information you are comfortable storing locally and sharing with the configured model. |
MEMORY.md |
Optional persistent memory | It is not auto-created. Create it only when you have a clear retention policy and know which facts belong there. |
Environment-specific instructions belong in AGENTS.md, not in a message you expect to remember from one conversation to the next. Remove boilerplate that could cause the agent to use a nonexistent tool, path, account, or approval process.
Protect the workspace like configuration and credentials
The workspace may contain private instructions, identity data, memory, generated files, and references to connected services. Keep it in a private Git repository or another access-controlled backup system. Do not publish it in a public repository, place it in a shared folder by accident, or include channel tokens in its history.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Before committing, review ignored files and staged changes. A private repository is useful for history and rollback, but it is not a substitute for encrypting sensitive credentials or restricting repository access.
5. Choose heartbeat behavior intentionally
Heartbeats are scheduled agent turns, not free status pings. Every enabled heartbeat can consume model tokens and create activity even when no human has sent a message. Start conservatively while you learn the installation.
Rank #3
- ➊ [ Trusted Quality for Everyday Agentic AI ] GEEKOM equips its SSDs with reliable original-grade flash and conducts rigorous stability testing to support dependable everyday operation. This commitment to quality is backed by a 3-year warranty. Simply connect the Air12 to cloud AI services for research, writing, study support and daily productivity—no NPU or complex local setup required. Designed for students, home users, light office work and first-time buyers, the Air12 is a high-value Cloud Agentic PC for everyday tasks
- ➋ [ Intel 7505 processor ] Powered by the Intel 7505 processor (2 cores, 4 threads, up to 3.5GHz), the GEEKOM Mini PC Air12 delivers smooth performance for everyday computing, office tasks, and home entertainment. With enhanced single-core processing, it handles daily workloads efficiently and responsively. Compact, quiet, and energy-efficient — a solid alternative to bulky desktops.
- ➌ [440lbs(200kg) Pressure Rated Metal Frame for Demanding Environments] Unlike the Plastic Shells You’ll Find on Most Mini PCs, geekom Mini Air12 features a triple-reinforced ABS+PC shell, precision-crafted metal frame and baseplate—engineered to withstand up to 440 lbs of pressure for the perfect balance of strength and thermal efficiency. Tool-free upgrades, shock-absorbing feet, and a 3D antenna deliver true durability
- ➍ [Dual-Channel RAM & NVMe SSD Expandability] Ships with 8GB DDR4 RAM and a 256GB NVMe SSD for smooth everyday performance. Dual memory slots and dual storage slots give you the flexibility to upgrade to 64GB RAM and 2TB SSD, so your system can adapt as your workload grows. Enjoy faster load times, smoother multitasking, and long-term reliability.
- ➎ [Triple 4K Displays for Maximum Productivity] Connect up to three 4K monitors via HDMI 2.0, Mini DisplayPort 1.4, and USB-C — ideal for stock trading dashboards, multi-tab research, office document editing, and light spreadsheet work. WiFi 6 and Bluetooth with high-gain antenna ensure stable wireless connections throughout your workspace. 5x USB ports and a full-size SD card reader provide quick access to peripherals and camera files — no adapters required.
The personal-assistant guide shows an evaluation setting of:
{
"agents.defaults.heartbeat.every": "0m"
}An interval of 0m disables the recurring heartbeat in that example. Use the configuration syntax required by your installed release, and choose a nonzero cadence only when you have a specific job for it, such as checking a queue or maintaining a routine.
Questions to answer before enabling a cadence
- What event is the heartbeat supposed to detect?
- Which tools may it use without asking for approval?
- Where should it report a result?
- How much model usage is acceptable for that schedule?
- What happens if the host is offline and several runs become due?
Log the chosen interval in AGENTS.md or your operations notes. If token use or unsolicited activity rises, return to 0m while investigating instead of adding more filters after the fact.
6. Add capabilities in stages
Once the Gateway, one channel, and access controls are reliable, extend the agent one capability at a time. OpenClaw’s documented extension areas include skills, plugins, browser and exec tools, cron jobs, hooks, webhooks, automation, and multi-agent routing.
A safe expansion sequence
- Skills: browse available skills and install only one whose purpose you can explain. Read its required permissions and files before enabling it.
- Plugins and channel adapters: add the next integration only after recording its credential owner and sender policy.
- Browser tools: test on a low-risk site or a read-only task first. Define whether navigation, downloads, and form submission require confirmation.
- Exec and file tools: start with the narrowest paths and commands. Keep destructive operations behind explicit approval.
- Cron jobs and hooks: create one scheduled action, observe its logs, and verify its behavior when the Gateway restarts.
- Webhooks and automation: authenticate requests, validate payloads, and decide how replayed or duplicate events are handled.
- Multi-agent routing: use it when workspaces or responsibilities genuinely need separation, not merely to make a single agent appear more complex.
After each addition, test three cases: the intended action, a denied action, and a restart. Record the permission boundary and rollback step before moving on. Capability growth should never outrun your ability to explain what the agent can do.
7. Back up before changing models, channels, or hosts
Make a backup before changing the model, adding a plugin, connecting another channel, or moving the Gateway to a new machine. Include:
- The OpenClaw configuration and service settings.
- Channel credentials and other secrets, stored in an encrypted or access-controlled form.
- The complete
~/.openclaw/workspacedirectory, includingAGENTS.md,SOUL.md,IDENTITY.md,USER.md, and anyMEMORY.md. - Local state required by installed plugins, automations, hooks, or scheduled jobs.
- A note of the OpenClaw release, Node version, operating system, and enabled channels.
The official documentation recommends treating the workspace as a private Git repository and using the documented backup and migration commands for the release you have installed. Command names and migration details can change; copy them from that release’s documentation rather than applying a command from an older installation.
Make the backup restorable
- Export or copy the configuration and workspace to protected storage.
- Verify that the copy contains the instruction files and expected local state, not just an empty directory.
- Check that secrets are readable only by the intended account or secret store.
- Write down the order for reinstalling Node, OpenClaw, the Gateway service, credentials, workspace, and channels.
- Perform a small restore test on a separate directory or test host before you depend on the backup.
Never commit raw bot tokens, private keys, or session databases to a repository, even when that repository is currently private. Remove a secret from the channel and rotate it if it was committed.
Rank #4
- 【AMD Ryzen 4300U True 4-Core CPU: Outperforms N95 & i3-10110U】KAMRUI P2 Mini PC is equipped with true 4-core AMD Ryzen 4300U processor built on advanced 7nm Zen2 architecture，This means you get consistent, unthrottled performance for hours on end, whether you’re running multiple browser tabs, streaming 4K content, or managing virtual machines. Compare that to Intel N95 (4 efficiency cores that throttle under load) or Intel i3-10110U (only 2 cores total), and the difference is night and day: The KAMRUI P2 AMD Ryzen 4300U (28W) is 40% faster than the Intel i3-10110U and 25% faster than the Intel N95 in multi-core tasks, ensuring smooth, lag-free performance even during heavy workloads.
- 【Integrated AMD Radeon Graphics: 2.5X Stronger for Tri 4K】The KAMRUI P2 AMD 4300U Mini PC have unlocked the full potential of the built-in AMD Radeon Vega 5 graphics with 28W power delivery, making it 2.5 times stronger than the Intel UHD graphics found in the N95 and i3-10110U. This means you can enjoy Tri 4K@60Hz displays without a single stutter, perfect for productivity setups, home theaters, or even light photo/video editing and casual gaming. While the Intel N95/i3-10110U struggle to run a single 4K display without lag, The KAMRUI AMD 4300U Mini PC handles Tri 4K effortlessly, turning your workspace into a high-efficiency hub or your living room into a premium entertainment center.
- 【Large Storage Capacity, Easy Expansion】KAMRUI Pinova P2 mini computers is equipped with 16GB LPDDR4 for faster multitasking and smooth application switching. 512GB M.2 SSD ensures fast startup, fast file transfers and plenty of storage space,eliminating slow loading times and ensuring fast responsiveness. the two storage slots (1x M.2 2280 SATA/NVMe PCIe3.0 slot, 1x M.2 2280 SATA slot) can be combined to provide up to 4TB of total storage(Not included). This gives you enough space for all your projects, media and data.
- 【4K Triple Display】KAMRUI Pinova P2 4300U mini desktop computers is equipped with HDMI2.0 ×1 +DP1.4 ×1+USB3.2 Gen2 Type-C ×1 interfaces for faster transmission, Triple 4K@60Hz Display, KAMRUI P2 mini computer is ideal for visual home entertainment, home office, conference rooms, etc. USB3.2 Gen2 Type-A port ×2 with a transfer speed of up to 10 Gbps (21 times faster than USB 2.0) for efficient data transfer. Ideal for seamless multitasking between spreadsheets, browsers and presentations, or for an immersive entertainment experience.
- 【USB3.2 Gen2 Type-C 10Gbps, Versatile connectivity】KAMRUI P2 mini desktop pc fast and versatile connectivity! The USB3.2 Gen2 Type-C port offers a data transfer rate of 10Gbps and simultaneously supports DisplayPort 1.4 video output. The P2 AMD Ryzen 4300U Mini PC is complemented by Gigabit LAN, WiFi and Bluetooth, so nothing stands in the way of a productive working environment.
8. Decide where the Gateway should live
A laptop is usually the simplest place to begin. It keeps the Gateway close to you and avoids another machine to administer, but it is unavailable when asleep, powered off, disconnected, or behind a changing home network. Continuous availability calls for a host that remains powered and connected.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Factor | Laptop or home machine | Raspberry Pi or other home server | VPS or cloud host |
|---|---|---|---|
| Availability | Depends on your sleep, travel, power, and network habits. | Can stay on continuously, subject to household power and internet reliability. | Designed for continuous operation, subject to provider and operating-system maintenance. |
| Control and privacy | Data and Gateway remain on your computer. | Data remains on premises and can be isolated on your network. | Provider infrastructure and remote administration become part of the trust boundary. |
| Maintenance | Fewest components, but your primary computer bears updates and interruptions. | You maintain power, storage, networking, backups, and updates. | You maintain the guest operating system, firewall, updates, and provider account. |
| Cost pattern | Uses existing hardware and electricity. | Requires upfront hardware and electricity. | Uses recurring hosting charges. |
| Remote access | May require a secure overlay or carefully designed port-forwarding approach. | Usually requires the same secure remote-access planning. | Reachable by design, but public exposure must still be limited with authentication and firewall rules. |
| Capacity | Depends on the laptop’s CPU, RAM, storage, and network. | Depends on the chosen board, storage, cooling, and workload. | Depends on the selected virtual CPU, RAM, storage, and network plan. |
OpenClaw’s installation documentation lists Raspberry Pi and VPS or cloud deployment paths, but it does not prescribe a Raspberry Pi model, RAM tier, storage device, provider, or performance guarantee. The cited documentation also does not publish a universal sizing table. Model calls, browser sessions, media processing, and plugins can stress different resources, so measure your actual workload rather than treating a generic hardware recommendation as a guarantee.
When a home server is a good fit
- You want the Gateway and workspace to remain on premises.
- You can provide reliable power, storage, updates, and a secure remote-access method.
- Your workload is modest enough for the hardware you select.
When a VPS is a good fit
- The agent must remain reachable while your home devices are offline.
- You are comfortable hardening and updating a remotely exposed operating system.
- You prefer a recurring, predictable hosting arrangement over buying and maintaining another device.
Neither choice is an official OpenClaw recommendation. Choose based on availability, privacy, maintenance skill, remote-access design, and measured workload.
9. Troubleshoot the first week methodically
| Symptom | Checks | Likely corrective action |
|---|---|---|
| Gateway stops when the terminal closes | Run openclaw gateway status and check whether the service was installed. |
Stop the foreground process and run openclaw gateway install; then verify the service manager entry. |
| Status is healthy but the dashboard cannot connect | Confirm the Gateway is listening on port 18789 locally and that the service account can read its configuration. |
Fix the service environment or permissions, restart the service, and rerun openclaw dashboard. |
| Private channel messages never arrive | Check the channel credential, pairing state, allowlist, and Gateway logs. | Complete pairing for the correct sender and remove conflicting or stale channel configuration. |
| An unknown sender receives replies | Review pairing approvals and channel allowlists immediately. | Stop the channel, deny or remove the sender, correct the policy, and rotate the credential if exposure is possible. |
| Heartbeat activity or token use is unexpectedly high | Inspect the heartbeat interval and scheduled jobs. | Set the heartbeat cadence to 0m while evaluating, then enable only the schedule you can justify. |
| A plugin works interactively but fails after reboot | Check service-account permissions, environment variables, paths, and startup logs. | Move required settings into the service environment or workspace instructions and test another restart. |
| Migration loses behavior or memory | Compare the new host with the recorded release, configuration, workspace, and local state. | Restore the complete backup and follow the migration procedure for the installed release instead of copying only chat transcripts. |
10. Runtime and release details to record
The current OpenClaw documentation recommends Node 26. Node 24.16 or later and Node 26.1 or later are listed as supported ranges. Record the exact Node version installed on the host because service managers may use a different executable than your interactive shell.
The documentation homepage identifies release v2026.10.3 as current on October 15, 2026. Configuration keys, migration commands, and plugin behavior can change between releases, so keep the release number with every backup and consult matching documentation when upgrading.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The getting-started copy describes setup as “about 5 minutes.” That is a marketing estimate, not an independently measured benchmark; service installation, channel approval, hardening, backups, and tool testing take additional time.
11. A practical completion checklist
- Persistence: the Gateway runs under the correct operating-system service and survives closing the setup terminal.
- Local verification:
openclaw gateway statusreports a healthy service listening on port18789, and the dashboard test succeeds. - Channel control: one private channel works, unknown senders remain unapproved, and an explicit allowlist is configured.
- Workspace: starter files have been reviewed, environment notes are in
AGENTS.md, and optional memory has a retention policy. - Heartbeat: the cadence is either disabled during evaluation or tied to a documented purpose and budget.
- Capabilities: skills, plugins, browser, exec, schedules, hooks, webhooks, and routing were added one at a time with permission tests.
- Recovery: configuration, credentials, workspace, memory, and local state are backed up privately, and a restore path is written down.
- Hosting: the selected laptop, home server, or VPS matches your required availability, privacy, maintenance capacity, and workload.
Once these checks pass, OpenClaw is no longer just a foreground demo: it is a persistent service with an explicit access policy, a known workspace contract, controlled capabilities, and a recovery plan.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
