OpenClaw Web Chat via Tailscale IP (Agent37 Setup Guide)

Do not index

Overview

This guide shows how to access OpenClaw Web Chat over your private Tailnet using a Tailscale IP (100.x.x.x), so you don’t need to expose the Web Chat port publicly.

Video walkthrough

What you’re setting up (quick mental model)

Your Agent37 instance runs OpenClaw and exposes the Web Chat UI on port 18789.

Tailscale gives the instance a private, routable Tailnet IP (100.x.x.x).

You open the Web Chat from your laptop at http://<instance-tailscale-ip>:18789/.

You must whitelist that browser origin in openclaw.json via gateway.controlUi.allowedOrigins.

You authenticate to the gateway using gateway.auth.token.

Prerequisites

An Agent37 instance you can open a terminal into

A Tailscale account (Google/GitHub/Microsoft/email login)

Tailscale installed on your laptop (signed into the same Tailnet)

Part A — Install + sign in to Tailscale on macOS

Step 1: Download

Go to https://tailscale.com/download

Download Tailscale for Mac (a .pkg installer)

Step 2: Install

Open the downloaded .pkg

Follow the prompts (Continue → Install)

Enter your Mac password if prompted

Step 3: Sign in

Open Tailscale (Applications → Tailscale)

Click Sign in

Complete authentication in your browser

Authorize your device

Toggle Tailscale On

You’ll see:

Status: Connected

Your Tailscale IP (100.x.x.x)

Step 4: Confirm it’s working

In the Tailscale app, verify the status shows Connected

Note your laptop’s Tailscale IP (100.x.x.x)

Part B — Connect your Agent37 instance to Tailscale

Step 1: Open the Agent37 terminal

Go to https://www.agent37.com/dashboard

Create an instance (or open an existing one)

Open Terminal for that instance

Step 2: Install Tailscale on the instance

Run:

curl -fsSL https://tailscale.com/install.sh | sh

Step 3: Start the Tailscale Daemon Automatically in the Background

if you access OpenClaw Web Chat using a Tailscale IP, you may find yourself manually starting tailscaled every time your instance restarts. To avoid that extra step, add the Tailscale daemon command to post-restart.sh so it runs automatically in the background.

Open post-restart.sh

nano .agent37/hooks/post-restart.sh

Add this command to post-restart.sh

sudo tailscaled \
	--tun=userspace-networking \
	--socket=/var/run/tailscale/tailscaled.sock \
	--state=/home/node/.openclaw/tailscaled.state \
	&

Save and exit

Ctrl + O to write out/save

Press Enter to confirm the filename

Ctrl + X to exit

If you press Ctrl + X first and it asks to save, press Y, then Enter

Restart your OpenClaw instance

After saving the file, restart your OpenClaw instance from the Agent37 dashboard.

Why this helps

Adding this command to post-restart.sh makes startup smoother:

You no longer need to manually start tailscaled each time.

The Tailscale daemon keeps running in the background.

OpenClaw Web Chat continues to work with the same Tailscale IP flow.

This is a small change, but it removes a repetitive manual step and makes the OpenClaw workflow much more convenient. If you regularly access OpenClaw Web Chat through Tailscale, this is an easy improvement that helps streamline the workflow.

Step 4: Bring Tailscale up (authenticate)

Open the Terminal and Run:

sudo tailscale up

You’ll see a login URL like https://login.tailscale.com/a/xxxxx.

Open that URL in your browser

Step 5: Verify the instance is online and get its Tailnet IP

Run:

tailscale status

You should see your instance with a 100.x.x.x IP and an online status, for example:

100.90.12.5  my-instance  online

Save this IP — you’ll use it in the Web Chat URL and in allowedOrigins.

Part C — Whitelist the Web Chat origin + copy the gateway token

This step prevents browser-origin/CORS blocks and ensures only allowed origins can open the control UI.

Step 1: Open `openclaw.json`

Go to https://www.agent37.com/dashboard

Open your instance

Go to Actions → Files

Open openclaw.json

Step 2: Add your Web Chat origin to `allowedOrigins`

Add the instance’s Tailscale IP with port 18789.

Use the same scheme you will use in the browser (typically http://).

The origin must match exactly: scheme + host + port.

Example:

"gateway": {
	"mode": "local",
	"controlUi": {
		"allowedOrigins": [
			"http://100.64.8.101:18789"
		]
	},
	"auth": {
		"mode": "token",
		"token": "xxxxxxxxxxxx"
	}
}

Step 3: Copy the gateway token

Copy gateway.auth.token — you’ll paste it into Web Chat when prompted.

Part D — Open Web Chat from your laptop

Step 1: Confirm both devices are on the same Tailnet

Laptop: Tailscale is On and shows Connected

Instance: shows online in tailscale status

Step 2: Open the Web Chat URL

In your browser, open:

http://<instance-tailscale-ip>:18789/