Skip to main content
OpenClaw is an open-source multi-channel messaging bot. It connects to Telegram, Discord, WhatsApp, and Slack, and replies using your choice of AI provider: Anthropic, OpenAI, Google, Mistral, Groq, OpenRouter, xAI, Moonshot, or a compatible custom endpoint (vLLM, Ollama, LM Studio, LiteLLM, and the like). This guide covers configuring OpenClaw on Suji. Check the version and release notes shown in the marketplace before installing or upgrading. OpenClaw itself is maintained upstream; Suji provides the marketplace packaging.

​
Before you install

You’ll need:
  • An AI provider API key (optional — OpenClaw boots unconfigured, so you can also skip this and set it later from the Terminal with the openclaw CLI). For example:
  • Optional channel credentials if you want messaging integrations. Telegram and Discord have install-time token fields; other channels are configured within OpenClaw. A channel is not required to install the gateway.

​
Install

Dashboard → Apps → OpenClaw → Install, then pick the VM to install on. OpenClaw boots with --allow-unconfigured, so the AI fields are optional. You can choose Skip & configure later, then set the provider, key, and model after install from the Terminal tab (pick OpenClaw) using the openclaw CLI. See Configure after a skip install below. A Small (2 vCPU / 4 GB) VPS with spare capacity is a starting point. The template declares 1 GiB minimum and 2 GiB recommended memory, and limits the gateway container to 2 GiB. Tool use and concurrency can need more. Click Deploy. Follow deployment progress until the install is running. Startup time varies with image downloads, initialization and VM capacity. You’ll see a public URL like https://<your-subdomain>.suji.fr — that’s the Control UI.

​
First connection (two one-time steps)

OpenClaw protects the Control UI with two layers. When connecting through the public tunnel, you may need both:
  1. Sign in with your gateway access token.
  2. Approve this browser (a one-time device pairing).
The install’s Deployment tab also walks you through these steps with the token revealable inline.

​
Step 1 — sign in with the access token

Click Open on the install page to load the Control UI. Its login screen asks for the gateway access token. That token is the Gateway access token from the install form (auto-generated if you left it blank). To get it:
  • Install detail page → Deployment tab → Getting started — reveal and copy it there, or
  • Install detail page → Variables tab → reveal OPENCLAW_GATEWAY_PASSWORD.
Paste it into the login screen. It stays the same unless you change or rotate it.

​
Step 2 — approve this browser

The first time you sign in, OpenClaw asks you to approve this browser and shows a command like:
Run that exact command (with the real id it showed you) from the dashboard:
  1. Instance page → Terminal tab → pick OpenClaw from the selector.
  2. Paste and run the command.
  3. Sign in again. The Control UI connects.
The approval request is short-lived, so approve it while the sign-in screen is still open. Pairing is per browser/device, so you’ll repeat this once for each new browser.

​
Configure after a skip install

If you chose Skip & configure later, the gateway can start without usable model credentials. Configure them before expecting AI replies. You can use the app’s Variables tab or the openclaw CLI from its Terminal; the settings available in the Control UI depend on the installed version. Instance page → Terminal tab → pick OpenClaw, then run the guided setup:
It walks you through credentials, model and channel settings. Follow its reload/restart instructions; not every setting takes effect without a gateway restart. To jump straight to one part, target a section:
Prefer non-interactive commands? They map one-to-one:
CLI changes write to OpenClaw’s persistent configuration. Restart the install when a changed setting requires it, and check the logs and a test conversation.
The template’s initialization step can select the model from AI_PROVIDER and AI_MODEL when the stack is redeployed. Keep those Variables consistent with a model selected through the CLI, so a later redeploy does not select a different model. A plain container restart is different from applying Variables or upgrading.

​
Connecting channels

You have two ways to add a channel:
  • Bot token (Telegram / Discord): set TELEGRAM_BOT_TOKEN or DISCORD_BOT_TOKEN in the install’s Variables tab and click Apply changes. The template supplies the token at startup; there is no Channels multiselect. Existing channel configuration may take precedence over an environment token.
  • CLI (other supported channels): from the Terminal (pick OpenClaw), run openclaw channels add and follow the prompts. Follow the channel instructions for your installed OpenClaw version. WhatsApp uses linked-device QR login; Slack Socket Mode uses bot and app credentials. These do not have single-token install fields.
Do not invent a generic /webhooks/<channel> endpoint. Use the transport and callback path required by OpenClaw’s channel documentation. WhatsApp QR login and Slack Socket Mode do not use that generic webhook URL. Confirm with a test message, then approve sender pairing and configure group/server allowlists where required. Channel pairing is separate from browser-device approval. See the channel guides.

​
Day-to-day management

​
Troubleshooting

Paste the Gateway access token (OPENCLAW_GATEWAY_PASSWORD). Reveal it on the install’s Deployment tab → Getting started, or the Variables tab. Use its current value; changing or rotating it invalidates the previous token.
The browser isn’t paired yet. Open the instance Terminal tab (pick OpenClaw), run the openclaw devices approve [id] command OpenClaw showed you, then sign in again. Pairing is per browser, so repeat on every new device.
OpenClaw isn’t reachable through the tunnel. Most common causes:
  • Container still starting — wait 30 s and retry, especially right after an upgrade.
  • Container crashing — Logs tab will show the reason. If it’s a permission error on /home/node/.openclaw, that’s a packaging issue — file a Suji support ticket.
OpenClaw runs as the node user. If the data volume’s ownership has drifted, OpenClaw can’t write its config. After backing up the data, use the host terminal and identify the running container for this OpenClaw install with docker ps, then replace OPENCLAW_CONTAINER with its actual container name or ID:
Fresh installs handle this automatically via an init-permissions container.
Check the mail tool or integration you configured, its credentials, and outbound network access. Use only the SMTP or API transport that integration supports; a Suji install does not configure email delivery automatically.
Expected. Pairing is per device — approve the new browser’s pairing request the same way as the first.

​
Where things live

Uninstalling deletes the volume by default. Choose keep data during uninstall to preserve it (you can reconnect to it later over SSH).
  • Small (2 vCPU / 4 GB) is a starting point with spare capacity, not a stability guarantee.
  • The compose caps OpenClaw at 2048 MiB and 1 vCPU. AI work itself runs at the provider (Anthropic / OpenAI) — local tools, browser tasks and channel processing still consume CPU and memory. The 2 GB ceiling is what actually matters: sustained high message volume can push memory usage if sessions accumulate, which is when an OOM kill would happen.
If you run multiple apps on the same VM, factor those caps in — the VM’s total CPU/memory is still shared.

​
Reporting issues