How to Set Up Tailscale with OpenClaw Web Chat

Do not index

Use this guide to install Tailscale, turn it on, get your Tailscale IP, and open OpenClaw Web Chat through your private tailnet. This is a practical way to access OpenClaw securely from another device without exposing the gateway on the public internet.

💡

What you are setting up. Your Agent 37 instance runs OpenClaw and exposes the Web Chat UI on port 18789. Tailscale gives the instance a private, routable tailnet IP in the 100.x.x.x range. You open Web Chat from your laptop at http://<instance-tailscale-ip>:18789/, whitelist that browser origin in openclaw.json under gateway.controlUi.allowedOrigins, and authenticate with gateway.auth.token.

Video walkthrough

What this setup does

Tailscale gives each approved device a private tailnet IP, usually in the 100.x.x.x range. Once the OpenClaw host is reachable through that network, you can open Web Chat from another approved device on the same tailnet.

Prerequisites

An Agent 37 instance you can open a terminal into

A Tailscale account (Google, GitHub, Microsoft, or email login)

Tailscale installed on your laptop, signed into the same tailnet

Part A: Install and sign in to Tailscale on macOS

Step 1: Download

Go to https://tailscale.com/download

Download Tailscale for Mac (a .pkg installer)

Step 2: Install

Open the downloaded .pkg

Follow the prompts (Continue, then Install)

Enter your Mac password if prompted

Step 3: Sign in

Open Tailscale (Applications, then Tailscale)

Click Sign in

Complete authentication in your browser

Authorize your device

Toggle Tailscale On. You will see status Connected and your Tailscale IP (100.x.x.x)

Step 4: Confirm it is working

In the Tailscale app, verify the status shows Connected

Note your laptop's Tailscale IP (100.x.x.x)

Part B: Connect your Agent 37 instance to Tailscale

Step 1: Open the Agent 37 terminal

Go to https://www.agent37.com/dashboard

Create an instance or open an existing one

Open Terminal for that instance

Step 2: Install Tailscale on the instance

Run:

curl -fsSL https://tailscale.com/install.sh | sh

Step 3: Start the Tailscale daemon automatically in the background

If you access OpenClaw Web Chat using a Tailscale IP, you may find yourself manually starting tailscaled every time your instance restarts. To avoid that extra step, add the Tailscale daemon command to post-restart.sh so it runs automatically in the background.

Open post-restart.sh:

nano .agent37/hooks/post-restart.sh

Add this command to post-restart.sh:

sudo tailscaled \
	--tun=userspace-networking \
	--socket=/var/run/tailscale/tailscaled.sock \
	--state=/home/node/.openclaw/tailscaled.state \
	&

Save and exit:

Ctrl + O to write out and save

Press Enter to confirm the filename

Ctrl + X to exit

If you press Ctrl + X first and it asks to save, press Y, then Enter.

Then restart your OpenClaw instance from the Agent 37 dashboard.

Adding this command to post-restart.sh makes startup smoother. You no longer need to start tailscaled by hand after each restart, the daemon keeps running in the background, and Web Chat keeps working with the same Tailscale IP flow.

Step 4: Bring Tailscale up (authenticate)

Open the Terminal and run:

sudo tailscale up

You will see a login URL like https://login.tailscale.com/a/xxxxx.

Open that URL in your browser

Step 5: Verify the instance is online and get its tailnet IP

Run:

tailscale status

You should see your instance with a 100.x.x.x IP and an online status, for example:

100.90.12.5  my-instance  online

Save this IP. You will use it in the Web Chat URL and in allowedOrigins.

Part C: Whitelist the Web Chat origin and copy the gateway token

This step prevents browser-origin and CORS blocks, and ensures only allowed origins can open the control UI.

Step 1: Open openclaw.json

Go to https://www.agent37.com/dashboard

Open your instance

In the Open Tools card, click File Browser

Open openclaw.json

Step 2: Add your Web Chat origin to allowedOrigins

Add the instance's Tailscale IP with port 18789. Use the same scheme you will use in the browser (typically http://). The origin must match exactly: scheme, host, and port.

Example:

"gateway": {
	"mode": "local",
	"controlUi": {
		"allowedOrigins": [
			"http://100.64.8.101:18789"
		]
	},
	"auth": {
		"mode": "token",
		"token": "xxxxxxxxxxxx"
	}
}

Step 3: Copy the gateway token

Copy gateway.auth.token. You will paste it into Web Chat when prompted.

Part D: Open Web Chat from your laptop

Step 1: Confirm both devices are on the same tailnet

Laptop: Tailscale is On and shows Connected

Instance: shows online in tailscale status

Step 2: Open the Web Chat URL

In your browser, open http://<instance-tailscale-ip>:18789/, for example http://100.90.12.5:18789/.

Step 3: Authenticate in the Web Chat UI

When prompted, paste the token from openclaw.json under gateway.auth.token.

Step 4: Validate it works

Click Connect and confirm you see a connected state

Send a test message in the chat box

Confirm that your OpenClaw bot responds normally

If the bot responds, your Web Chat is working through Tailscale.

Troubleshooting

Page does not load

Confirm the instance is online with tailscale status

Confirm you used the correct instance IP (100.x.x.x)

Confirm you included the port :18789

Origin not allowed or CORS issues

Ensure gateway.controlUi.allowedOrigins includes the exact origin you opened: http://100.x.x.x:18789 (scheme, IP, and port must match)

If you changed the IP (new instance) or changed ports, update allowedOrigins accordingly

Token rejected

Make sure you copied gateway.auth.token, not another token

Re-open openclaw.json and copy it again, avoiding hidden whitespace

Instance appears offline

Re-run sudo tailscaled ... & if the daemon is not running

Re-run sudo tailscale up if the node is not authenticated

Multiple accounts or devices

Laptop and instance must be signed into the same tailnet and account in Tailscale

When to use this setup

This setup is a good fit when you want secure remote access without exposing a public port, access to Web Chat from another laptop or a mobile device, or a simple private-network workflow for testing OpenClaw.

💡

This approach works best when both your OpenClaw host and your client devices stay connected to the same Tailscale network. It gives you private access without the usual public networking setup.