Tutorial: How to Secure Access to OpenClaw (AI Agent) on DigitalOcean with Access Server⁠

To deploy OpenClaw, create a new Droplet using the DigitalOcean marketplace:

• OpenClaw | DigitalOcean Marketplace

1. Sign in to your DigitalOcean account and click Create OpenClaw Droplet.

2. Select your Droplet plan and data center region.

3. Select your authentication method.

4. Configure any optional settings, and click Create Droplet.

After the Droplet launches, connect to it using SSH.

1. Open a terminal or SSH client.

2. Connect to the Droplet using the root user:

   ssh -i /path/key-pair-name.pem root@instance-ipv4-address

   1. 1

      Replace with your private SSH key.

   2. 2

      Replace with your Droplet's public IP address.

3. After connecting, the OpenClaw configuration tool runs automatically.

   • You'll see a prompt similar to this:

     --- AI Provider Selector ---
     1) GradientAI
     2) OpenAI
     3) Anthropic
     4) OpenRouter
     5) OpenClaw Model Setup
     Select a provider (1-5):

4. Choose the AI provider you want to use.

5. When prompted for an AI model access key:

   • Enter the key if available, or

   • Press Ctrl+C to skip and configure later.

You need to retrieve the OpenClaw gateway token to access the dashboard.

1. On the OpenClaw server console, grab the gateway token:

   grep OPENCLAW_GATEWAY_TOKEN /opt/openclaw.env

   • Example output:

     OPENCLAW_GATEWAY_TOKEN=ABCDE12345

2. Copy the token value (for example, ABCDE12345) and store it securely.

You'll use this token later to access the OpenClaw gateway.

The DigitalOcean OpenClaw image includes Caddy, which acts as the web server. Configure it so OpenClaw listens only on the Droplet's private IP address.

1. Retrieve the Droplet private IP address (in this case, we'll get the one for eth1):

   PRIVATE_IP=$(ip -4 addr show eth1 | grep -o 'inet [0-9.]*' | cut -d' ' -f2)

   • Example private IP:

     192.0.2.5

2. Edit the Caddy configuration so it listens only on the private IP:

   sudo tee /etc/caddy/Caddyfile > /dev/null <<EOF
   ${PRIVATE_IP} {
       reverse_proxy localhost:18789
       header X-DO-MARKETPLACE "openclaw"
   }
   EOF

openclaw.example.com

To restrict access to OpenClaw, configure Access Server routing rules so traffic to the OpenClaw host is only available through the VPN.

1. Sign in to the Access Server Admin Web UI.

2. Click Access Controls.

   • The Group and User Access Rules tab is displayed.

3. Click the Global Access Rules tab.

4. Under IP Addresses and Subnets, select the routing mode NAT.

   • This makes the source IP appear as the Access Server private IP.

5. Enter the OpenClaw Droplet private IP in the IP Addresses and Subnets field. Example:

   192.0.2.5

6. Click Save and Restart.

Now confirm that OpenClaw can only be accessed through the VPN.

1. Connect to the Access Server VPN.

2. Open a web browser.

3. Navigate to the OpenClaw gateway URL:

   https://<openclaw-private-ip>/#token=<openclaw-token>

   Replace:

   • <openclaw-private-ip> with the private IP.

   • <openclaw-token> with your gateway token.

   Example:

   https://192.0.2.5/#token=ABCDE12345

   If using a domain:

   https://openclaw.example.com/#token=ABCDE12345

4. The OpenClaw gateway dashboard should display.

5. Disconnect from the VPN and try to access the public IP address. The connection should fail, confirming that access is restricted to VPN users.