How to Set Up OpenClaw on Hetzner (Complete Guide)

Go to hetzner.com and create an account. Once you're in, go to the Cloud Console and click "Add Server".

Choose your settings:

Set up an SSH key (recommended)

An SSH key is like a digital password that's impossible to guess. It's a pair of files on your computer — one public (you give to Hetzner) and one private (stays on your computer). When you connect, they match up automatically.

ssh-keygen -t ed25519 -C "your-email@example.com"

Press Enter 3 times to accept the defaults. This creates your key pair.

# Mac
cat ~/.ssh/id_ed25519.pub | pbcopy

# Windows (PowerShell)
Get-Content ~/.ssh/id_ed25519.pub | Set-Clipboard

# Linux
cat ~/.ssh/id_ed25519.pub

Paste this into the "SSH Key" field in Hetzner when creating your server.

Name your server something memorable (like "openclaw" or "my-ai-bot"), then click Create & Buy.

Wait about 30 seconds for the server to spin up. Once it's ready, copy the IP address — you'll need it in the next step.

You're going to use your computer's terminal to connect to the server over the internet. Don't worry — it's just typing a command.

Open your terminal

ssh root@YOUR_IP_ADDRESS

Replace YOUR_IP_ADDRESS with the IP you copied from Hetzner (something like 49.13.xx.xx).

The first time you connect, it'll ask: "Are you sure you want to continue connecting?" Type yes and press Enter. This is normal — it's just your computer confirming the server is legit.

Right now you're logged in as root — the all-powerful admin account. That's like driving with no speed limit. Let's create a regular user for OpenClaw instead.

# Create a new user called "openclaw"
adduser openclaw

# Give it permission to use sudo when needed
usermod -aG sudo openclaw

# Switch to that user
su - openclaw

It'll ask you for a password and some optional info (full name, etc). Set a password, press Enter through the rest.

Node.js is the engine that runs OpenClaw. Think of it like needing Java to run Minecraft — OpenClaw needs Node.js to work.

curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get install -y nodejs

The first command adds the Node.js download source. The second installs it. This might take a minute.

node --version

You should see something like v22.x.x. If you see that, you're good. If not, run the install commands again.

curl -fsSL https://openclaw.ai/install.sh | bash

This downloads and installs OpenClaw. Wait for it to finish.

Run the onboarding wizard

openclaw onboard --install-daemon

The wizard will walk you through the initial setup. It'll ask you for:

Verify it's running

openclaw gateway status

You should see something telling you the gateway is running. If it says "running" — you're golden.

You're going to create a Telegram bot and connect it to OpenClaw. This lets you message your AI assistant just like texting a friend.

Step A: Create your bot

Step B: Add the token to your config

Open your OpenClaw config file:

nano ~/.openclaw/openclaw.json

Add the Telegram section (or update it if it already exists):

{
  "channels": {
    "telegram": {
      "botToken": "YOUR_BOT_TOKEN_FROM_BOTFATHER",
      "dmPolicy": "pairing",
      "groupPolicy": "disabled"
    }
  }
}

Save the file: Ctrl+X → Y → Enter.

Step C: Restart and pair

openclaw gateway restart

Now open Telegram and send a message to your bot. Because we set dmPolicy to "pairing", the first time you message it, the bot will give you a pairing code. Run the command it tells you to approve the pairing. After that, you're connected!

OpenClaw needs an API key from Anthropic to access Claude. This is what you're paying for when you use the AI — each message costs a tiny amount.

Get your API key

Understanding the models

Add your API key via the onboarding wizard or directly in your config file. If you already ran the wizard and it asked for the key, you're all set.

We're going to do three quick things: change the default port, set a password, and turn on the firewall.

Change the default port

OpenClaw runs on port 8080 by default. That's public knowledge. Let's change it so automated scanners don't find your bot.

{
  "gateway": {
    "port": 39217
  }
}

Pick any number between 10000 and 65535. Don't use the example — pick your own.

Set an auth token

This is like a password for the OpenClaw gateway itself. Anyone trying to connect needs this token.

{
  "gateway": {
    "port": 39217,
    "auth": {
      "mode": "token",
      "token": "YOUR-STRONG-PASSWORD-HERE"
    }
  }
}

Use a long random password — 20+ characters. Mix letters, numbers, and symbols.

Turn on the firewall

# Allow your OpenClaw port
sudo ufw allow 39217/tcp

# Allow SSH (so you don't lock yourself out!)
sudo ufw allow ssh

# Turn it on
sudo ufw enable

# Verify it's working
sudo ufw status

UFW blocks all incoming connections except the ones you specifically allowed. Everything else gets silently dropped.

OpenClaw can spawn "subagents" — smaller AI workers that handle tasks autonomously. Docker puts them in sealed containers so even if something goes wrong, your server stays safe.

curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker openclaw

The first command installs Docker. The second gives your openclaw user permission to use it.

exit
su - openclaw

Add sandbox config

Add this to your openclaw.json:

{
  "agents": {
    "defaults": {
      "sandbox": {
        "mode": "non-main",
        "workspaceAccess": "rw",
        "network": "bridge"
      }
    }
  }
}

Open your config file and replace everything with this complete configuration:

nano ~/.openclaw/openclaw.json

{
  "gateway": {
    "port": 39217,
    "auth": {
      "mode": "token",
      "token": "YOUR-STRONG-PASSWORD-HERE"
    }
  },
  "channels": {
    "telegram": {
      "botToken": "YOUR_BOT_TOKEN_FROM_BOTFATHER",
      "dmPolicy": "pairing",
      "groupPolicy": "disabled"
    }
  },
  "agents": {
    "defaults": {
      "sandbox": {
        "mode": "non-main",
        "workspaceAccess": "rw",
        "network": "bridge"
      }
    }
  }
}

Save the file (Ctrl+X → Y → Enter), then restart:

openclaw gateway restart

Check the gateway

openclaw gateway status

Should say it's running. If not, check the logs for errors.

Send a test message

Open Telegram. Send your bot a message like "Hello! What can you do?"

If it responds — you did it! 🎉 Your personal AI assistant is live.

Test subagents

Try asking your bot something that requires a subagent, like: "Spawn a subagent to research the latest news about AI." If it spawns a subagent and reports back, Docker sandbox is working.

Check logs

openclaw logs

If something isn't working, the logs will tell you why. Error messages here are your best debugging tool.

Restart OpenClaw

openclaw gateway restart

After any config change, restart the gateway for changes to take effect.

Update OpenClaw

npm install -g openclaw

Check for updates regularly. New versions include bug fixes and features.

Session cleanup (recommended)

OpenClaw stores conversation sessions. Over time they build up. Set up automatic cleanup every 72 hours by telling your bot:

Set up a cron job to clean up old sessions every 72 hours.

Back up your workspace with Git

cd ~/.openclaw/workspace
git init
git add -A
git commit -m "Initial backup"

# Add a remote (GitHub, etc) and push
# git remote add origin YOUR_REPO_URL
# git push -u origin main

This way if anything goes wrong, you can always restore your workspace files.