OpenClawDocs
View as MarkdownView this page as plain textOpen in ChatGPTAsk questions about this pageOpen in ClaudeAsk questions about this page

CLI commands

Configure

openclaw configure

Interactive prompts for targeted changes to an existing setup: credentials, devices, agent defaults, gateway, channels, plugins, skills, and health checks.

Use openclaw onboard or openclaw setup for the full guided first-run journey, openclaw setup --baseline for the baseline config/workspace only, and openclaw channels add when you only need channel account setup.

Options

Before openclaw configure changes local credentials or configuration, OpenClaw compares the selected CLI state/config paths with the local Gateway or its installed service. A proven mismatch stops before the write. A remote Gateway or an authenticated path that cannot be verified produces a warning instead.

This comparison also applies when OPENCLAW_HOME relocates the CLI's default state directory. The installed service's recorded environment determines its paths, including while the Gateway is stopped. The CLI's path overrides do not replace them. If the service definition or its recorded paths cannot be verified, OpenClaw warns and leaves configuration available. Inspect the service with openclaw gateway status --deep before relying on local changes to reach it.

--section <section>: repeatable section filter. Available sections:

workspace, model, web, gateway, daemon, channels, plugins, skills, health

bash
openclaw configureopenclaw configure --section webopenclaw configure --section model --section channelsopenclaw configure --section gateway --section daemon

Selecting gateway, daemon, or health (or running the full wizard with no --section) prompts where the Gateway runs and updates gateway.mode. Section filters that skip all three go straight to the requested setup with no gateway-mode prompt. Picking remote gateway mode writes the remote config and exits immediately. It does not run local-only steps like plugin installs.

Gateway, daemon, health, and web settings do not require an agent owner. Workspace, model, plugin, skill, and channel setup use the configured System Agent in an explicit fleet. If none is configured, the wizard asks which existing agent to use. That selection applies to the remaining agent-scoped sections without changing the System Agent setting. Channel setup uses the selected workspace for plugin discovery. Removing channel configuration does not require an agent selection.

Gateway section

First-run openclaw onboard and openclaw setup generate a Gateway secret in token mode without a token/password picker. They preserve existing password mode. Use their --gateway-auth password or --gateway-password <value> flags to choose a password explicitly. Tailscale Funnel still requires password mode. The local configure Gateway section retains its auth-mode picker for targeted reconfiguration. The mode selects the configured secret. Clients may send it in either auth.token or auth.password.

Remote configuration asks for one Gateway secret and stores it as gateway.remote.token, whether the remote Gateway calls it a token or password.

For Trusted Proxy auth, enter comma-separated IPv4 or IPv6 addresses or CIDR ranges, such as 10.0.0.1, ::1, 10.0.0.0/24. The wizard rejects malformed addresses and empty entries before saving. It ignores surrounding whitespace.

For Trusted Proxy auth, an address or CIDR that matches a loopback source shows a security warning. The wizard then asks for explicit consent before it sets gateway.auth.trustedProxy.allowLoopback. Declining leaves it unset and warns that loopback proxy requests will be rejected at runtime. See Trusted proxy auth for the trust requirements.

Reconfiguring trusted-proxy mode defaults the loopback prompt to the existing opt-in and preserves deviceAutoApprove unchanged. An explicit refusal revokes loopback consent. Without a matching loopback source, the existing setting is retained.

Model section

When configure starts from a provider auth choice, the default-model and model-policy pickers prefer that provider automatically. For paired providers such as Volcengine and BytePlus, the same preference also matches their coding-plan variants (volcengine-plan/*, byteplus-plan/*). If the preferred-provider filter would produce an empty list, configure falls back to the unfiltered catalog instead of showing a blank picker.

Web section

openclaw configure --section web picks a web-search provider and configures its credentials. Some providers show provider-specific follow-ups:

  • Grok can offer optional x_search setup with the same xAI OAuth profile or API key, and let you pick an x_search model.
  • Kimi can ask for the Moonshot API region (api.moonshot.ai vs api.moonshot.cn) and the default Kimi web-search model.

Other notes

  • Gateway reconfiguration preserves existing gateway.auth.allowTailscale, gateway.auth.rateLimit, and gateway.auth.identityScopes policies. The selected auth mode replaces its credentials or trusted-proxy settings and removes fields belonging to other auth modes.
  • After local config writes, configure installs selected downloadable plugins when the chosen setup path requires them. Remote gateway config does not install local plugin packages.
  • Channel-oriented services (Slack/Discord/Matrix/Microsoft Teams) prompt for channel/room allowlists during setup. You can enter names or IDs. The wizard resolves names to IDs when possible.
  • Choosing Reinstall keeps the existing Gateway service in place while you select its runtime and configure validates authentication and prepares the replacement. Cancelling or failing during preparation leaves the existing service installed.
  • After successful daemon setup, the final Gateway status uses the same platform-specific startup grace period as onboarding before reporting reachability. Service installation and Gateway reachability are separate outcomes. If the Gateway is still not detected, run openclaw health to check it again.
  • If you run the daemon install step, token auth requires a token. If gateway.auth.token is SecretRef-managed, configure validates the SecretRef. It does not persist resolved plaintext token values into supervisor service environment metadata. If the SecretRef is unresolved, configure blocks daemon install with actionable remediation guidance.
  • If both gateway.auth.token and gateway.auth.password are configured and gateway.auth.mode is unset, configure blocks daemon install until you set the mode explicitly.
Was this useful?
On this page

On this page