Remote Access for Agentbot Agents

Agentbot now lets users choose how they want to reach their OpenClaw Gateway remotely. The default is still no extra remote access. If you need it, pick SSH, Tailscale Serve, Tailscale Funnel, or a direct Tailnet bind.

The Core Idea

OpenClaw has one Gateway that owns sessions, channels, auth, and state. Your browser, phone, desktop app, or node connects to that Gateway. For the safest setup, keep the Gateway bound to loopback and let SSH or Tailscale carry remote traffic to it.

Option 1: Remote over SSH

Choose SSH when you already have shell access to the host and want the most boring, reliable remote path. Agentbot stores the user choice for guidance, but it does not change the server exposure.

ssh -N -L 18789:127.0.0.1:18789 user@host

With the tunnel open, connect tools and clients to ws://127.0.0.1:18789. SSH does not bypass Gateway auth, so keep your normal OpenClaw token or password ready.

Option 2: Tailscale Serve

Tailscale Serve is the recommended tailnet mode. The Gateway stays on loopback, and Tailscale provides HTTPS, routing, and identity headers inside your tailnet.

{
  "remoteAccess": {
    "type": "tailscale-serve",
    "authKey": "tskey-auth-...",
    "hostname": "agentbot-studio",
    "tags": ["tag:agentbot"]
  }
}

Create the auth key in your own Tailscale admin console. Use an ephemeral key for short-lived agents, or a tagged reusable key for agents you expect to keep running.

Option 3: Tailscale Funnel

Funnel exposes the Gateway through public HTTPS. OpenClaw requires password auth for this mode, and Agentbot requires the password in the setup payload. Use Funnel only when public access is intentional.

{
  "remoteAccess": {
    "type": "tailscale-funnel",
    "authKey": "tskey-auth-...",
    "hostname": "agentbot-public-demo",
    "password": "shared-gateway-password"
  }
}

Option 4: Tailnet IP

Tailnet IP mode tells OpenClaw to bind directly to the Tailnet address with token auth. This skips Tailscale Serve and Funnel, so you connect with plain HTTP or WebSocket over your private tailnet.

{
  "remoteAccess": {
    "type": "tailnet",
    "authKey": "tskey-auth-...",
    "hostname": "agentbot-tailnet"
  }
}

From another Tailnet device, connect to http://<tailscale-ip>:18789/ or ws://<tailscale-ip>:18789.

Need Help Choosing?

Agentbot exposes a setup helper endpoint for product surfaces and API clients:

GET /api/remote-access/options

It returns each remote access mode, required fields, optional fields, and setup steps. Use it to build a guided flow instead of asking users to know the network details up front.