exe.dev

Goal: OpenClaw Gateway running on an exe.dev VM, reachable from your laptop via:

This page assumes exe.dev's default exeuntu image. If you picked a different distro, map packages accordingly.

Beginner quick path

1. https://exe.new/openclaw
2. Fill in your auth key/token as needed
3. Click on "Agent" next to your VM and wait for Shelley to finish provisioning
4. Open
   text

   Copy

   https://<vm-name>.exe.xyz/
   and authenticate with the configured shared secret (this guide uses token auth by default, but password auth works too if you switch
   text

   Copy

   gateway.auth.mode
   )
5. Approve any pending device pairing requests with
   text

   Copy

   openclaw devices approve <requestId>

What you need

• exe.dev account
• text

  Copy

  ssh exe.dev
  access to exe.dev virtual machines (optional)

Automated install with Shelley

Shelley, exe.dev's agent, can install OpenClaw instantly with our prompt. The prompt used is as below:

text
Copy
Set up OpenClaw (https://docs.openclaw.ai/install) on this VM. Use the non-interactive and accept-risk flags for openclaw onboarding. Add the supplied auth or token as needed. Configure nginx to forward from the default port 18789 to the root location on the default enabled site config, making sure to enable Websocket support. Pairing is done by "openclaw devices list" and "openclaw devices approve <request id>". Make sure the dashboard shows that OpenClaw's health is OK. exe.dev handles forwarding from port 8000 to port 80/443 and HTTPS for us, so the final "reachable" should be <vm-name>.exe.xyz, without port specification.

Manual installation

1) Create the VM

From your device:

bash
Copy
ssh exe.dev new

Then connect:

bash
Copy
ssh <vm-name>.exe.xyz

2) Install prerequisites (on the VM)

bash
Copy
sudo apt-get update
sudo apt-get install -y git curl jq ca-certificates openssl

3) Install OpenClaw

Run the OpenClaw install script:

bash
Copy
curl -fsSL https://openclaw.ai/install.sh | bash

4) Setup nginx to proxy OpenClaw to port 8000

Edit

with

text
Copy
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    listen 8000;
    listen [::]:8000;

    server_name _;

    location / {
        proxy_pass http://127.0.0.1:18789;
        proxy_http_version 1.1;

        # WebSocket support
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Standard proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeout settings for long-lived connections
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }
}

Overwrite forwarding headers instead of preserving client-supplied chains. OpenClaw trusts forwarded IP metadata only from explicitly configured proxies, and append-style

chains are treated as a hardening risk.

5) Access OpenClaw and grant privileges

Access

(see the Control UI output from onboarding). If it prompts for auth, paste the configured shared secret from the VM. This guide uses token auth, so retrieve with (or generate one with ). If you changed the gateway to password auth, use / instead. Approve devices with and . When in doubt, use Shelley from your browser!

Remote channel setup

For remote hosts, prefer one

call over many SSH calls to . Keep real tokens in the VM environment or , and put only SecretRefs in .

On the VM, make the service environment contain the secrets it needs:

bash
Copy
cat >> ~/.openclaw/.env <<'EOF'
SLACK_BOT_TOKEN=xoxb-...
SLACK_APP_TOKEN=xapp-...
DISCORD_BOT_TOKEN=...
OPENAI_API_KEY=sk-...
EOF

From your local machine, create a patch file and pipe it to the VM:

json5
Copy
// openclaw.remote.patch.json5
{
  secrets: {
    providers: {
      default: { source: "env" },
    },
  },
  channels: {
    slack: {
      enabled: true,
      mode: "socket",
      botToken: { source: "env", provider: "default", id: "SLACK_BOT_TOKEN" },
      appToken: { source: "env", provider: "default", id: "SLACK_APP_TOKEN" },
      groupPolicy: "open",
      requireMention: false,
    },
    discord: {
      enabled: true,
      token: { source: "env", provider: "default", id: "DISCORD_BOT_TOKEN" },
      dmPolicy: "disabled",
      dm: { enabled: false },
      groupPolicy: "allowlist",
    },
  },
  agents: {
    defaults: {
      model: { primary: "openai/gpt-5.5" },
      models: {
        "openai/gpt-5.5": { params: { fastMode: true } },
      },
    },
  },
}

bash
Copy
ssh <vm-name>.exe.xyz 'openclaw config patch --stdin --dry-run' < ./openclaw.remote.patch.json5
ssh <vm-name>.exe.xyz 'openclaw config patch --stdin' < ./openclaw.remote.patch.json5
ssh <vm-name>.exe.xyz 'openclaw gateway restart && openclaw health'

Use

when a nested allowlist should become exactly the patch value, for example when replacing a Discord channel allowlist:

bash
Copy
ssh <vm-name>.exe.xyz 'openclaw config patch --stdin --replace-path "channels.discord.guilds[\"123\"].channels"' < ./discord.patch.json5

Remote access

Remote access is handled by exe.dev's authentication. By default, HTTP traffic from port 8000 is forwarded to

with email auth.

Updating

bash
Copy
npm i -g openclaw@latest
openclaw doctor
openclaw gateway restart
openclaw health

Guide: Updating

Related

• Remote gateway
• Install overview