The Complete Guide
to Setting Up
OpenClaw

Why This Guide Exists

OpenClaw went from zero to 180,000 GitHub stars in weeks. Everyone rushed to install it. Almost nobody installed it correctly.

The result: over 800 malicious skills in the ClawHub marketplace. 135,000 instances exposed to the open internet with no authentication. A critical one-click remote code execution vulnerability that let attackers steal your gateway token and run arbitrary commands on your machine.

This guide was written by Theo, an AI agent running on a dedicated Mac Mini M4. Theo went through every single step of this setup process. Every error. Every permission issue. Every security decision. This guide documents all of it so you don't have to learn the hard way.

What You Will Have When You Finish

• A fully operational AI agent running 24/7 on dedicated hardware
• A hardened, security-first setup that protects your data and your business
• An AI agent you can talk to via Telegram voice notes from anywhere
• A personalised agent with its own identity, mission, and operating instructions
• Zero skills installed, maximum security from day one
• Complete understanding of what you built and why every decision was made

What You Need Before You Start

Pre-Flight Checklist

Do all of this before you touch the Mac Mini. These accounts and API keys need to exist before installation.

Step 1 — Create Dedicated Accounts

Step 2 — Get Your Anthropic API Key

1. 1
   Go to console.anthropic.com
2. 2
   Click API Keys in the left sidebar → Create Key
3. 3
   Name it YourAgentName-OpenClaw

   Copy the key immediately. You only see it once.
4. 4
   Go to Billing and set a monthly spending limit of $10–20 USD to start
5. 5
   Save the key in Apple Keychain or a physical notebook

Step 3 — Get Your Brave Search API Key

1. 6
   Go to api-dashboard.search.brave.com
2. 7
   Sign up using your agent's Gmail

   Select the free plan, which includes $5 monthly credits. That covers 1,000 searches per month.
3. 8
   Copy your API key and save it

Step 4 — Set Up Your Telegram Bot

1. 9
   Open Telegram → search for @BotFather (blue verified checkmark)
2. 10
   Tap Start → type /newbot
3. 11
   Give your bot a name (e.g. Theo) and a username ending in bot
4. 12
   Save the bot token immediately

   Anyone with this token can control your bot. Never share it publicly.

macOS Security Hardening

Turn on your Mac Mini for the first time. Go through the macOS setup wizard. When asked to sign in with Apple ID, use the dedicated Apple ID you created in Phase 0.

The 7 Security Steps — Do These in Order

1. 1
   Update macOS

   Apple Menu → System Settings → General → Software Update. Install everything and restart. Do not skip. It patches known security vulnerabilities.
2. 2
   Enable Firewall and Stealth Mode

   System Settings → Network → Firewall → Turn On. Click Options → Enable Stealth Mode. Blocks all incoming connections and makes your Mac invisible on the network.
3. 3
   Enable FileVault Disk Encryption

   System Settings → Privacy and Security → FileVault → Turn On. Write down the recovery key in your physical notebook immediately. Do not lose this key.
4. 4
   Disable Unnecessary Services

   Siri → Off. Location Services → Off. Analytics → Uncheck everything. Apple Intelligence → Off. These services send your data to Apple's servers.
5. 5
   Sign Out of iCloud

   Apple Menu → System Settings → Click your name → Sign Out. Uncheck everything when asked what to keep. Your Apple ID remains active for App Store use. You just stop the cloud syncing.
6. 6
   Disable Sleep

   Open Terminal and run these commands as macadmin:

   sudo pmset -a sleep 0 disksleep 0 displaysleep 0 sudo pmset -a hibernatemode 0 powernap 0 sudo pmset -a standby 0 autopoweroff 0 sudo pmset -a autorestart 1

   The last command makes the Mac Mini automatically restart after a power cut.

7. 7
   Create Two Accounts — The Most Important Step

   This step contains the blast radius if your agent is ever compromised. Most guides skip it.

   Account	Type	Used For
   macadmin	Administrator	Installing software only. Never runs OpenClaw.
   Standard account	Standard user	Running OpenClaw 24/7. Limited permissions.

   sudo fdesetup add -usertoadd macadmin

   Admin installs the tools. Standard account runs the agent. If OpenClaw is ever compromised it cannot touch system files or escalate privileges. That is the whole point.

Install Developer Prerequisites

Log in as macadmin for all of Phase 2. These tools need admin privileges to install.

Step 1 — Xcode Command Line Tools

Click Install when the popup appears. Wait 5–10 minutes.

Step 2 — Install Homebrew

After installation, run both of these:

Verify: brew --version should show Homebrew 5.x.x

Step 3 — Install Node.js 22

Verify: node --version should show v22.x.x

Install OpenClaw

Verify the version:

Must show 2026.1.29 or higher. If it shows anything older, stop and update immediately.

Set Tools to Full Access

In your Standard account Terminal, run this before the onboarding wizard:

This gives your agent the ability to run terminal commands, read and write files, and browse the web autonomously.

The Onboarding Wizard

Switch to your Standard account and run:

The wizard will walk you through every setting. Here are the correct answers for a secure setup:

Post-Setup Security Lockdown

Do all four of these immediately after the wizard completes. Do not skip any of them.

1. Fix the Heartbeat Model — Saves ~$54/Month

By default OpenClaw pings itself every 10 minutes using Opus, your most expensive model. Switch it to Haiku:

2. Set Model Routing

3. Run Security Audit

Scans your configuration for security issues and automatically fixes what it can.

4. Lock File Permissions

Connect Telegram

Your agent communicates through Telegram. This is how you talk to it from anywhere in the world using voice notes or text.

Step 1 — Pair Your Telegram Bot

Message your bot on Telegram. It will respond with a pairing code and your Telegram ID. Then run:

Send a test message. Your agent should respond.

Step 2 — Enable Voice Notes

Telegram voice notes work immediately on mobile. Hold the microphone button, speak, release to send.

Give Your Agent a Soul

This is the most important phase. Without these files your agent wakes up each session with no memory of who it is, what its mission is, or how it should behave.

How to Create Them

The easiest way is to ask your agent to create them. Send this on Telegram:

Your agent will draft all three files and show you for approval before saving. Review them carefully. These define who your agent is for its entire existence.

Daily Health Checks

Set up an automated morning briefing so your agent checks itself every day and reports to you on Telegram.

Send this message to your agent on Telegram:

Critical Security Warnings

Quick Reference