OpenClaw Cheatsheet

Use this as an operator runbook for daily checks, onboarding, and incident response.

Core commands

openclaw doctor --fix
openclaw gateway status
openclaw gateway health --token <TOKEN>
openclaw devices list --json
openclaw devices approve <REQUEST_ID>

Docker quick checks

docker ps
docker logs --tail 200 openclaw
docker exec openclaw sh -lc 'env | sort'
docker restart openclaw

Health verification sequence

1. Confirm container is up.
2. Confirm gateway is listening on expected port.
3. Validate token auth from UI.
4. Validate one end-to-end prompt.
5. Check logs for reconnect loops.

Common errors and fixes

• disconnected (1008): origin not allowed

Add the exact UI origin to gateway.controlUi.allowedOrigins.

• unauthorized: gateway token missing

Open with ?token=<gateway-token> or paste token in Control UI settings.

• unauthorized: device token mismatch

Re-pair the browser device and reissue token.

• Telegram 404 from getMe

Bot token is invalid or revoked; replace token and restart.

• 502 bad gateway via reverse proxy

Check upstream target/port and container network route.

Security baseline

• Keep auth mode token-only unless password flow is required.
• Rotate gateway tokens periodically.
• Keep channel tokens outside source control.
• Restrict SSH ingress to specific CIDR if enabled.