OpenClaw Security Best Practices

Security Overview

OpenClaw is powerful — it can read files, execute commands, and browse the web. With great power comes the need for thoughtful security configuration.

API Key Security

Storage

• Never hardcode keys in configuration files that might be shared
• Use environment variables or a .env file
• Add .env to your .gitignore

Rotation

• Rotate API keys periodically (every 90 days recommended)
• If a key is exposed, revoke it immediately and generate a new one
• Monitor provider dashboards for unusual usage

Scope

• Use keys with minimum required permissions
• Create separate keys for different services
• Don't share a single key across multiple tools

Tool Permissions

Principle of Least Privilege

Only enable the tools your workflow requires:

{
  "tools": {
    "read": { "enabled": true },
    "write": { "enabled": true, "confirm": true },
    "shell": { "enabled": false },
    "browser": { "enabled": false }
  }
}

Confirmation Mode

Enable confirmation for destructive tools:

• write — Can overwrite files
• edit — Can modify files
• shell — Can execute any command
• browser — Can interact with websites

Restricted Commands

Block dangerous shell commands:

{
  "tools": {
    "shell": {
      "blocked_commands": [
        "rm -rf /",
        "sudo",
        "chmod 777",
        "curl | sh"
      ]
    }
  }
}

Network Security

• Run behind a firewall when possible
• Use HTTPS for all webhook endpoints
• Limit outbound connections if your environment allows
• Monitor network traffic for unexpected connections

Channel Security

• Keep bot tokens secret — never share them publicly
• Use separate bot tokens for testing and production
• Regularly audit who has access to your bot
• Enable message encryption where available (Signal, WhatsApp)

Data Protection

• Conversation history is stored locally in plain text
• Encrypt your disk for at-rest protection
• Consider excluding sensitive directories from file tool access
• Review MEMORY.md periodically — remove outdated sensitive data

Claw for All Security

Claw for All adds infrastructure-level security:

• Dedicated VMs with isolated environments
• Encrypted storage
• Automated security updates
• No shared resources between users