A self-hosted agent gateway is a powerful thing to leave on the open internet. Exposed instances get found, and an agent with tools and keys is a bigger prize than a plain web app. This checklist covers the settings that matter most before you go live.
Do not expose it directly to the internet. Bind the gateway to loopback or a private network like Tailscale, require authentication in front of it, store keys as least-privilege secrets outside your code, keep the runtime updated, and limit what the agent can reach so a mistake or compromise has a small blast radius.
Biggest risk
An agent gateway open to the internet
First fix
Bind to loopback or a private network
Key handling
Least-privilege secrets, never in code
Goal
A small blast radius if something slips
Self-hosted gateway hardening checklist
Area
Do this
Why it matters
Network
Bind to loopback; reach it over Tailscale or a VPN.
Keeps the agent off the public internet.
Auth
Require a token or an authenticated proxy.
Stops anyone from driving your agent.
Secrets
Least-privilege keys in a secret store.
Limits the damage if one credential leaks.
Updates
Patch the runtime on a schedule.
Closes known holes before they are used.
Blast radius
Non-root user, spend caps, human review.
Keeps a single mistake small.
Do not bind it to a public interface
The most common mistake is running the gateway on 0.0.0.0 and reaching it by public IP. Exposed agent and LLM endpoints are a recurring research finding, not a theoretical risk: while disclosing CVE-2024-37032, Wiz reported on the order of a thousand Ollama servers reachable from the open internet, and anything listening on a public port is indexed by scanners like Shodan within hours. CISA considers exposed management interfaces serious enough that it directs US federal agencies to remove them from the internet. An agent gateway holding tools and credentials is a bigger prize than either. OpenClaw's gateway listens on loopback (ws://127.0.0.1:18789) by default; verify nothing has rebound it, and reach it over a private network instead.
Keep the gateway on 127.0.0.1, never 0.0.0.0.
Reach it over Tailscale, a VPN, or an SSH tunnel, not a public port.
If it must be public, put it behind a reverse proxy that enforces auth and TLS.
Verify the gateway is not listening publicly
# The local address should be 127.0.0.1:18789, not 0.0.0.0:18789 or [::]:18789
ss -tlnp | grep 18789
Reach it privately instead: SSH tunnel or Tailscale
# From your machine: forward the gateway to localhost over SSH
ssh -N -L 18789:127.0.0.1:18789 agent-host
# Or expose it only inside your tailnet
tailscale serve --bg 18789
An agent endpoint with no auth is an open door. Put authentication in front of it so only you, or your own systems, can send it instructions. If the gateway must be reachable beyond loopback, terminate TLS at a reverse proxy that enforces a credential on every request.
Require a token or an authenticated proxy for every request.
Do not treat an obscure URL or port as a secret.
Rotate the credential if it is ever shared, logged, or leaked.
An agent's model keys, tokens, and integration credentials are the real target. Treat them as least-privilege secrets that live outside your code and can be rotated on their own. On a self-hosted box, that means an environment file owned by the agent's user, readable by no one else, and loaded by the service manager rather than pasted into shells or prompts.
Store secrets in an env file or a secret store, never in the repo or the prompt.
Give each integration the narrowest scope it can work with.
Use separate credentials per agent so one leak does not unlock everything.
Lock the env file down and load it via systemd
install -m 600 -o openclaw-agent -g openclaw-agent .env /etc/openclaw/agent.env
# in the unit file:
[Service]
EnvironmentFile=/etc/openclaw/agent.env
Keep it updated and limit the blast radius
Agents move fast and so do their dependencies. Patch the runtime on a schedule, and assume any single agent could misbehave, so nothing it can reach is catastrophic on its own. The unit file below is the same pattern Qoren uses in production for every managed OpenClaw gateway: a dedicated non-root user, automatic restarts, and hard memory and CPU ceilings, with a few standard systemd hardening directives added on top.
Update the runtime and dependencies on a schedule, not just after an incident.
Run the agent as a non-root user with only the file and network access it needs.
Set spend limits and human review on any action that touches money or customers.
If keeping all of this current is not how you want to spend your time, managed hosting does it by default. Qoren runs OpenClaw and Hermes in isolated environments with authentication, secret storage, updates, and hard spend caps handled for you, so the secure path is the default one.
An agent is not a static site. It holds keys, can use tools, and can take actions. If its gateway is reachable without authentication, anyone who finds it can make it act with your credentials, which is why exposed instances are a documented and recurring problem.
Run OpenClaw or Hermes without managing infrastructure.
Deploy a managed agent environment, configure the runtime, and keep the agent online without Docker, VPS setup, or server maintenance.
