OpenClaw HostingOpenClaw Hosting Checklist for Production
Use this checklist before you onboard paid customers to your managed OpenClaw stack.
1. Lock network exposure
- Expose only the required port through a reverse proxy.
- Keep SSH closed by default and enable it only when a customer asks.
- Allow access from trusted CIDRs when SSH is enabled.
2. Make auth explicit
- Use token-based gateway auth.
- Add origin allow-list entries for your login and dashboard domains.
- Rotate gateway tokens when a device mismatch is detected.
3. Add bootstrap observability
- Persist `/var/log/clawstack/init.log` and `/var/log/clawstack/bootstrap.log`.
- Store startup failures in your instance record for quick support diagnosis.
- Report health only after gateway and proxy checks pass.
← Back to blog