How to Get Started with OpenClaw in 2026 — Complete Beginner's Setup

OpenClaw is an open-source AI agent framework that lets you build, deploy, and manage autonomous AI agents. Unlike closed-source alternatives, OpenClaw gives you full control over your data and infrastructure — which is exactly why it's exploding in popularity in 2026.

Whether you're a developer looking to automate workflows, a startup building AI-powered products, or just someone curious about running your own AI agent, OpenClaw is the tool to learn. Here's why:

• Open source — free to use, inspect, and modify
• Self-hostable — your data stays on your servers
• Extensible — plugins, custom tools, and integrations with everything
• Active community — thousands of contributors and a thriving ecosystem

This guide walks you through everything from installation to running your first agent. No prior experience needed.

Before we start, make sure you have these basics covered:

• A computer running macOS, Linux, or Windows (WSL2 recommended for Windows users)
• Node.js 20+ installed — check with node --version
• Git installed — check with git --version
• A terminal you're comfortable with (Terminal.app, iTerm2, Windows Terminal, etc.)
• 8GB+ RAM — OpenClaw runs local models efficiently, but you need headroom

Don't have Node.js yet? The fastest way to install it:

# macOS / Linux (using nvm - recommended)
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
nvm install 20
nvm use 20

# Verify installation
node --version  # Should show v20.x.x
npm --version   # Should show 10.x.x

If you're on Windows, install WSL2 first, then follow the Linux instructions inside your WSL terminal. Trust us — this saves headaches down the road.

OpenClaw offers two installation methods. We recommend the CLI for beginners:

Option A: Global CLI Install (Recommended for Beginners)

# Install the OpenClaw CLI globally
npm install -g @openclaw/cli

# Verify it worked
openclaw --version

This gives you the openclaw command everywhere on your system. Simple and clean.

Option B: Docker Install (Recommended for Production)

# Pull the official Docker image
docker pull openclaw/openclaw:latest

# Run OpenClaw
docker run -d --name openclaw \
  -p 3000:3000 \
  -v openclaw_data:/app/data \
  openclaw/openclaw:latest

Docker is better for production deployments because it isolates OpenClaw from your system. But for learning, the CLI is easier.

Pro tip: If you get permission errors with the global npm install, don't use sudo. Instead, fix your npm permissions or use nvm (which avoids this issue entirely).

Now let's create your first OpenClaw project. This sets up the folder structure and configuration files you'll need:

# Create a new project directory
mkdir my-first-agent && cd my-first-agent

# Initialize an OpenClaw project
openclaw init

# You'll see this structure:
# my-first-agent/
# ├── openclaw.config.yaml    # Main configuration
# ├── agents/                  # Your agent definitions
# │   └── assistant.yaml       # Default agent
# ├── tools/                   # Custom tool scripts
# ├── prompts/                 # Reusable prompt templates
# └── .env.example             # Environment variables template

The openclaw init command creates everything you need. Let's look at the most important file — openclaw.config.yaml:

# openclaw.config.yaml
project:
  name: my-first-agent
  version: 1.0.0

runtime:
  model: default          # Uses the default model
  temperature: 0.7        # Creativity level (0 = precise, 1 = creative)
  max_tokens: 4096        # Maximum response length

security:
  sandbox: true           # Run tools in a sandboxed environment
  allow_network: false    # Disable network access by default
  log_level: info         # Logging verbosity

Important: Notice the security section. OpenClaw ships with sandbox mode enabled by default — this is good. Don't disable it unless you know exactly what you're doing.

Before running your agent, you need to set up your environment variables. Copy the example file and fill in your details:

# Copy the environment template
cp .env.example .env

# Open it in your editor
nano .env   # or code .env, vim .env, etc.

Here's what each variable does:

# .env file
OPENCLAW_API_KEY=your_api_key_here    # Get this from your OpenClaw dashboard
OPENCLAW_MODEL=gpt-4o                  # Or any supported model
OPENCLAW_LOG_DIR=./logs                # Where to store logs
OPENCLAW_SANDBOX=true                  # Keep this enabled!

Where do I get an API key?

1. Create an account at the OpenClaw dashboard
2. Navigate to Settings → API Keys
3. Click "Generate New Key"
4. Copy it immediately — you won't see it again
5. Paste it in your .env file

Security reminder: Never commit your .env file to Git. The .gitignore generated by openclaw init already excludes it, but double-check. A leaked API key can cost you money and compromise your data.

This is the moment you've been waiting for. Let's start your first agent:

# Start the default agent in interactive mode
openclaw run

# You should see:
# 🟢 OpenClaw v3.2.0 started
# 📎 Agent: assistant (default)
# 🔒 Sandbox: enabled
#
# Type your message and press Enter.
# Type /help for commands, /quit to exit.

Try a few things:

# Ask it something simple
> What's the weather API endpoint for OpenWeatherMap?

# Ask it to write code
> Write a Python function that reads a CSV file and returns the top 5 rows

# Ask it to use a tool
> Search my project files for any TODO comments

You'll notice the agent asks for confirmation before executing tools that access your filesystem or network. This is the sandbox in action — protecting you from unintended side effects.

Useful CLI commands while the agent is running:

/help      — Show all available commands
/tools     — List available tools
/history   — Show conversation history
/clear     — Clear the conversation
/export    — Export conversation to a file
/quit      — Exit the agent

The default agent is fine for learning, but OpenClaw's real power is in custom agents. Let's create one:

# Create a new agent definition
openclaw agent create code-reviewer

This creates agents/code-reviewer.yaml. Open it and customize:

# agents/code-reviewer.yaml
name: code-reviewer
description: Reviews code for bugs, security issues, and best practices

system_prompt: |
  You are an expert code reviewer. When given code, you:
  1. Check for bugs and logic errors
  2. Identify security vulnerabilities
  3. Suggest performance improvements
  4. Verify best practices are followed
  Always explain your reasoning and provide fixed code examples.

tools:
  - file_read       # Can read project files
  - file_search     # Can search across files
  - web_search      # Can look up documentation

constraints:
  - no_file_write   # Cannot modify files (read-only reviewer)
  - no_execute      # Cannot run commands

Now run it:

# Run your custom agent
openclaw run --agent code-reviewer

# Point it at a file
> Review the code in src/auth.js for security issues

Notice the constraints section — we've restricted this agent to read-only mode. It can review code but can't modify or execute anything. This is the principle of least privilege, and it's essential for building agents you can trust.

Tools are what make OpenClaw agents useful beyond just chatting. Here's how to add them:

# List available built-in tools
openclaw tools list

# Install a community tool
openclaw tools install @openclaw/tool-github

# Install a tool from a Git repo
openclaw tools install https://github.com/user/custom-tool.git

Popular tools to start with:

• @openclaw/tool-github — Create issues, open PRs, review code
• @openclaw/tool-slack — Send messages, read channels
• @openclaw/tool-postgres — Query databases safely (read-only by default)
• @openclaw/tool-web — Browse and extract data from websites
• @openclaw/tool-shell — Execute shell commands (use with caution!)

Each tool requires explicit permission in your agent's YAML configuration. OpenClaw follows a deny-by-default model — agents can only use tools you explicitly allow.

# Enable a tool for your agent in its YAML file:
tools:
  - github:
      permissions:
        - read_issues
        - create_comments    # Can comment, but NOT close issues
  - postgres:
      connection: $DATABASE_URL
      permissions:
        - read_only          # Can query, but NOT write

This granular permission system is what makes OpenClaw safer than most alternatives. Never give an agent more permissions than it needs.

Before you dive deeper, run through this quick security checklist. If you can check every box, you're in great shape:

• ✅ .env file is in your .gitignore
• ✅ Sandbox mode is enabled in openclaw.config.yaml
• ✅ API key has been stored securely (not hardcoded in any file)
• ✅ Agent permissions follow the principle of least privilege
• ✅ Network access is disabled unless explicitly needed
• ✅ 2FA is enabled on your OpenClaw dashboard account
• ✅ Logs directory is not publicly accessible

Missing any of these? Fix them now. It takes 5 minutes and prevents 90% of common security issues.

This checklist covers the basics, but there's much more to learn about securing your OpenClaw setup — especially if you're deploying agents in production, handling sensitive data, or building tools that access external services.

Want the complete security playbook? The LearnClaw Security Guide covers 30+ chapters of security hardening, compliance checklists (GDPR & CCPA), and real-world scenarios with step-by-step solutions.

Congratulations — you now have a working OpenClaw setup! Here's what to explore next:

• Build more agents — try creating agents for different tasks (writing, research, code review, data analysis)
• Explore the plugin ecosystem — the OpenClaw community has published hundreds of tools and integrations
• Set up CI/CD — use OpenClaw agents in your development pipeline for automated code review and testing
• Join the community — the OpenClaw Discord and forums are excellent resources for getting help and sharing ideas
• Harden your security — this guide covers the basics, but production deployments need more advanced security measures

The single most important thing you can do right now? Secure your setup properly. Most OpenClaw incidents happen because users skip the security basics. Don't be that person.

Check out our other articles on the VibeLab blog for more OpenClaw tips, security guides, and tutorials. And if you want a comprehensive, step-by-step security playbook, the LearnClaw Security Guide has everything you need.