Quick Start

In AWS Console:

1. Go to aws.amazon.com → Create account
2. EC2 Dashboard → Launch instance
3. Name: OpenClaw
4. AMI: Ubuntu 24.04 LTS - free tier eligible
5. Instance Type: t3.small (free tier)
6. Key pair: Create new → name it openclaw-key → download .pem file
7. Network: Default VPC
8. Security Group: Create new with these inbound rules:
   • SSH port 22 from My IP only
   • HTTP port 80 from anywhere (0.0.0.0/0)
   • HTTPS port 443 from anywhere (0.0.0.0/0)
9. Storage: 20 GB
10. Launch → wait for "running" status → note the Public IPv4 address

On your computer:

chmod 600 ~/Downloads/openclaw-key.pem
ssh -i ~/Downloads/openclaw-key.pem ubuntu@YOUR_PUBLIC_AWS_IP

On EC2 (logged in as ubuntu):

Step 1: Create admin user

sudo adduser clawadmin
sudo usermod -aG sudo clawadmin

Set a password and hit enter through the rest.

Step 2: Copy SSH keys to clawadmin

sudo mkdir -p /home/clawadmin/.ssh
sudo cp /home/ubuntu/.ssh/authorized_keys /home/clawadmin/.ssh/
sudo chown -R clawadmin:clawadmin /home/clawadmin/.ssh
sudo chmod 700 /home/clawadmin/.ssh
sudo chmod 600 /home/clawadmin/.ssh/authorized_keys

Step 3: Test clawadmin login (new terminal on your computer)

ssh -i ~/Downloads/openclaw-key.pem clawadmin@YOUR_PUBLIC_AWS_IP

Step 4: Enable UFW firewall (logged in as clawadmin)

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw enable

Type y when prompted.

Step 5: Harden SSH config

sudo nano /etc/ssh/sshd_config

Use Ctrl+W to find each setting, uncomment it (remove the #), and match these values:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers clawadmin

AllowUsers clawadmin usually doesn't exist - add it as a new line at the bottom. Save: Ctrl+O, Enter, Ctrl+X. Then:

sudo systemctl restart ssh

Step 6: Lock ubuntu user and install fail2ban

sudo usermod -L ubuntu
sudo apt update
sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

On EC2 (logged in as clawadmin):

Step 1: Install OpenClaw

curl -fsSL https://openclaw.ai/install.sh | bash

The installer handles Node.js automatically and launches the onboarding wizard. If it starts onboarding straight away, skip to Step 2. If you need to install manually (Node.js 22.19+ minimum, 24 recommended):

sudo apt update && sudo apt install -y curl
curl -fsSL https://deb.nodesource.com/setup_24.x | sudo bash -
sudo apt install -y nodejs
sudo npm install -g openclaw@latest

Step 2: Run onboarding

openclaw onboard --install-daemon

When the wizard finishes, select "Hatch in TUI" to drop into the Terminal User Interface.

Step 1: Create a private Discord server

In Discord, click the + in the server list → Create My Own → For me and my friends. Name it something like "My OpenClaw". Create a channel called openclaw inside it.

Step 2: Create a Discord application and bot

1. Go to discord.com/developers/applications
2. New Application → name it OpenClaw → agree to terms → Create
3. Left sidebar → Bot
4. Click Reset Token → confirm → immediately click Copy and save it somewhere safe. Discord won't show it again without another reset.
5. Click Save Changes

Step 3: Enable required intents

1. Still on the Bot page, scroll to Privileged Gateway Intents
2. Toggle on: Message Content Intent (required), Server Members Intent (required), Presence Intent (optional - enable it while you're here)
3. Click Save Changes

Step 4: Generate invite link and add bot to your server

1. Left sidebar → OAuth2 → URL Generator
2. Scopes: check bot and applications.commands
3. Permissions: View Channels, Send Messages, Read Message History, Embed Links, Attach Files, Add Reactions
4. Copy the generated URL, paste it in your browser, select your private server, click Authorize

Step 5: Add Discord to your OpenClaw config

nano ~/.openclaw/openclaw.json

Use Ctrl+W to search for "gateway". After the closing brace of the gateway block (add a comma after it if there isn't one), add:

"channels": {
  "discord": {
    "enabled": true,
    "token": "YOUR_BOT_TOKEN_FROM_STEP_2",
    "dmPolicy": "pairing"
  }
},

Save: Ctrl+O, Enter, Ctrl+X. Then restart:

openclaw gateway restart

Wait 15-20 seconds. Your bot should appear online in Discord. DM it or @mention it in your #openclaw channel - it'll respond.

You've already done the hardest parts (key-only SSH, IP-restricted access). Keep these habits:

• Run openclaw update regularly to stay on the latest version
• Run sudo apt update && sudo apt upgrade to keep the OS patched
• Check openclaw logs --follow occasionally - abnormal activity shows up here
• Never store API keys, passwords, or sensitive files where your agent can read them
• If your bot token ever leaks - go straight to the Discord Developer Portal and reset it
• Back up ~/.openclaw/ somewhere safe and offline

Full prompt injection and security hardening guide - worth reading before you start using your agent with anything sensitive.