> gateway & service
The gateway is the long-running process that serves every channel, the Control UI, and the agent runtime at once, on port 18789 by default. Install it as a per-user service (launchd/systemd) so it survives reboots, or run it in the foreground with openclaw gateway run to watch logs while you debug. Its security model assumes the gateway can execute shell commands, so it binds to loopback and requires auth for anything remote — reach it over an SSH tunnel or Tailscale rather than a public bind.
// gateway & service
7 commands$ openclaw gateway install$ openclaw gateway start$ openclaw gateway status$ openclaw gateway run$ openclaw logs --follow$ ssh -N -L 18789:127.0.0.1:18789 user@host$ openclaw gateway run --bind tailnet// faq
What port does the OpenClaw gateway use?
18789 by default, for both the WebSocket API and the Control UI at http://127.0.0.1:18789/. The --dev profile shifts to 19001 so a dev instance does not collide with your real one. Change it with gateway.port in openclaw.json (a restart-required setting) or --port on openclaw gateway run.
Should I install the gateway as a service or run it in the foreground?
Install it as a service (openclaw gateway install, or onboard --install-daemon) for normal always-on use — it starts on login and restarts on crash. Use openclaw gateway run for debugging: it attaches to your terminal with logs on stdout. Running both at once causes two gateways to fight over the port, which openclaw gateway status --deep will flag.
Where are the gateway logs?
Persisted logs live in ~/.openclaw/logs/. Tail them live with openclaw logs --follow. For a shareable bug report, openclaw gateway diagnostics export bundles sanitized logs (default 5000 lines) with health and stability snapshots into a single zip.
How do I access the dashboard from another device?
Do not bind the gateway to 0.0.0.0 — it can run shell commands, so an open bind is remote code execution. Instead keep it on loopback and either forward the port over SSH (ssh -N -L 18789:127.0.0.1:18789 user@host) for occasional access, or use Tailscale Serve for an always-on path where Tailscale handles identity. Both remote paths still require gateway auth.
Why did my config change not take effect?
Most edits hot-apply because gateway.reload.mode defaults to hybrid, but server-level settings — port, auth, TLS, bind — are restart-required. hybrid restarts automatically for those; hot mode only logs a warning and keeps the old value. Run openclaw gateway restart to force it.