OpenClaw Control UI Guide

The Control UI is served by the Gateway and uses the same port for the page and its WebSocket connection. The default local address is http://127.0.0.1:18789/.

Open the owner session

On the Gateway host, use:

openclaw dashboard

This is preferable to typing the address into a new browser because it can create a short-lived owner handoff for that browser profile. Each browser profile has its own device identity; private windows and cleared site storage appear as new devices.

Authentication and pairing

Gateway authentication happens before device pairing. A loopback connection does not automatically bypass a configured token or password.

If the Gateway needs a persistent token, generate and inspect it on the host:

openclaw doctor --generate-gateway-token
openclaw gateway auth-token --show

If the UI reports that pairing is required, review and approve the current request:

openclaw devices list
openclaw devices approve <requestId>

Re-run the list command immediately before approval because a retry with changed scopes can replace the request ID.

Confirm the connection

Open Settings → Connection and check the Gateway host, runtime, uptime, and storage details. Then send a short message in a new session.

Expected result

• The page loads from the intended Gateway address.
• The WebSocket remains connected.
• The browser appears as an approved device.
• A new chat turn reaches the selected model.

Do not expose port 18789 directly to the public internet. Use localhost, an SSH tunnel, or an authenticated private-network route described in the remote access guide.