In this guide, we will install free and open-source OpenClaw AI on a self-hosted DigitalOcean Ubuntu 24.04 droplet (VM), connect it to the OpenAI API, and run your first agent using the built-in TUI and the local Web UI via SSH tunneling. The setup is a bit hands-on, but it pays off with flexibility.
What is OpenClaw and why host it on your own VM? OpenClaw is a framework for running AI agents with a modular architecture (agents, channels, skills, hooks, gateway). The initial onboarding can feel more “systems-y” than a typical SaaS chatbot, because you are operating a real service on a Linux server. That is also the advantage: once the base is in place, you can iterate quickly and safely on more advanced agent strategies (tool use, channel integrations like Telegram or WhatsApp, controlled permissions, and repeatable deployments).
Multi-agent architecture and why it matters! OpenClaw is not limited to a single agent. You can run multiple agents with clearly separated roles that cooperate with each other. For example, one agent can plan, another can execute tasks, and a third can review or validate outputs.
Requirements
- A cloud VM (DigitalOcean droplet). A regular 2 GB RAM / 2 vCPU instance is enough because we will not run local models.
- Ubuntu 24.04.
- An LLM API key (OpenAI, Gemini, Anthropic). In this article we use OpenAI.
- SSH key-based login already configured by DigitalOcean (root user).
- In commands below, VMIP represents your droplet public IP address.
- We use vim (vi) as text editor. You can use nano if you prefer.
Note on security and operations: since you are hosting an agent runtime on a public VM, treat it like any internet-exposed server. Use SSH keys, disable password auth, keep packages updated, and run daily work as a non-root user.
Create the droplet and do the essential server admin work
Create a DigitalOcean droplet with Ubuntu 24.04, add your SSH key, and then connect as root:
1) Log in as root
-
ssh root@VMIP
2) Update base system packages
-
apt-get update && apt-get upgrade
If the upgrade asks questions, the safest default for a fresh droplet is typically to accept the default option unless you intentionally modified configs.
3) Optional utilities
-
apt-get install mc
Why: mc (Midnight Commander) is a useful file manager.
4) Harden SSH (recommended)
-
vi /etc/ssh/sshd_config
Make sure you have:
- PasswordAuthentication no
Then restart SSH:
-
/etc/init.d/ssh restart
Why: disabling password authentication reduces brute-force risk. Since you already rely on SSH keys, this is usually the right move for production-like servers.
5) Create a non-root user (we use “david”)
-
adduser david
Choose a secure password. You will use it for sudo prompts. It does not need to be extremely long, but it should not be guessable.
6) Allow sudo for the new user
-
usermod -aG sudo david
7) Set up SSH keys for david (copy from root)
-
mkdir /home/david/.ssh
-
cp /root/.ssh/authorized_keys /home/david/.ssh/
-
chmod 700 /home/david/.ssh/ && chmod 600 /home/david/.ssh/authorized_keys && chown david:david -R /home/david/.ssh
Why: correct ownership and permissions are required or SSH may ignore the keys for security reasons.
8) Set timezone
-
dpkg-reconfigure tzdata
Why: correct time is essential for troubleshooting, logs, and scheduled tasks. It also avoids confusion when reviewing agent runs and gateway logs.
Install OpenClaw, connect OpenAI, and run your first agent
From this point, work as the non-root user for day-to-day operations.
1) Log in as david
-
ssh david@VMIP
2) Install uv (Python tooling)
-
curl -LsSf https://astral.sh/uv/install.sh | sh && source $HOME/.local/bin/env
Why: OpenClaw’s ecosystem relies on modern Python packaging and dependency handling. uv is a fast, clean toolchain that helps keep installs predictable.
3) Install Homebrew (Linuxbrew)
-
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
Why: OpenClaw’s installer can leverage system tooling that Homebrew simplifies on Linux. It also helps keep your server packages separated from Ubuntu’s system packages, which can reduce dependency conflicts.
4) Install OpenClaw (starts onboarding automatically)
-
curl -fsSL https://openclaw.ai/install.sh | bash
5) Onboarding choices (recommended for a first install)
- Select QuickStart
- Paste your OpenAI API key and choose your desired GPT model
OpenClaw onboarding
- Skip channel for now (we keep the first run local and simple)
- Do not configure skills yet (start minimal, then add tools intentionally)
- Skip hooks for now
- Select Hatch in TUI (recommended)
- And complete the onboarding chat with your new agent – who you are, who he/she is, etc.
OpenClaw agent alive
Congratulations! This first pass intentionally keeps the attack surface low and the configuration straightforward. After you confirm everything works, you can add channels (for example Telegram, WhatsApp, Discord, Slack, etc), skills, and hooks step-by-step with confidence.
6) Exiting the TUI
- Press ctrl+c
Access the OpenClaw Web UI safely via SSH tunneling
OpenClaw’s Web UI typically binds to localhost for safety, which means it is not directly reachable from the public internet. That is a good default for security. The standard approach is to create an SSH tunnel from your laptop to the VM and access the UI through your local browser.
1) Start the tunnel from your laptop (local machine)
-
ssh -L 18789:127.0.0.1:18789 david@VMIP
2) Open the UI in your browser on your laptop
- http://127.0.0.1:18789/
3) Configure the Gateway Token in the UI
Go to Overview and fill in Gateway Token. You will find it on your VM in:
- /home/david/.openclaw/openclaw.json
Look for the gateway section. This file is effectively the main OpenClaw configuration on the server, so treat it as sensitive data and do not share it publicly. Quite a large part of the system configuration is done by editing this file directly.
After the token is set, you should be able to chat with your agent directly from Chrome while keeping the service private behind SSH.
Useful OpenClaw commands (run on the VM as david)
- openclaw tui
- openclaw gateway restart
- openclaw agents list
- openclaw channels list
- openclaw doctor
If the openclaw command is missing for you then you may need to log off and log in again to reload bash variables such as the PATH variable. Official documentation is here: https://docs.openclaw.ai/
Conclusion
You now have OpenClaw installed on Ubuntu 24.04 DigitalOcean VM, connected to the OpenAI API, and accessible through both the TUI and the local Web UI using SSH tunneling. The initial setup has a bit of complexity, but that structure is what unlocks safer iteration: you can add channels (like Telegram, WhastApp, Slack, Discord, etc.), skills, and hooks in controlled steps.
The real power begins with multi-agent setups. Once you create multiple agents that cooperate with each other, creativity expands significantly. You can separate roles (e.g., planner, executor, reviewer), let agents delegate tasks between themselves, and build structured workflows. This is where the system evolves from a single assistant into a coordinated, intelligent network.