The OpenClaw Gateway, explained

Every OpenClaw guide mentions the Gateway and few explain it. It is the one always-on process that everything else talks to, and most of the errors people paste into forums, from pairing loops to a dashboard that will not connect, are about it. Here is what it is, how to tell whether it is healthy, and what a managed host does with it.

What the Gateway is

One process for routing, the control plane and the channel connections, on a single multiplexed port: the WebSocket control channel, the HTTP APIs, plugin routes, the Control UI and hooks. By default it binds to loopback, so nothing reaches it from outside the machine unless you tunnel in or deliberately expose it behind a shared secret.

• The Control UI lives on the Gateway’s port, 18789 by default, and needs the Gateway token.
• Config reloads watch the active config file and swap the in-memory snapshot atomically.
• The heartbeat, the automations and the channel workers all run inside it, which is why one stuck process looks like everything is broken.

How to tell whether it is healthy

Upstream gives a command ladder, and it is worth memorising: status, gateway status, follow the logs, doctor, then probe the channels. Healthy means the runtime is running, the connectivity probe is ok and each channel reports a live transport; anything else has its own runbook page grouped by symptom, from updates and rollbacks to a channel that connects but does not deliver.

gateway.err.log accumulated over 109,000 errors.

The failure modes you will read about

• Pairing required, in a loop: the client and the Gateway disagree about who has been approved.
• A Control UI that will not connect: usually the token, the port, or a tunnel that dropped.
• Split-brain installs after an update, where two versions each think they own the service.
• Memory pressure on a small host, which ends the process with exit code 137.

What a managed host does with it

On Diali the Gateway is the thing you never see. It runs inside your assistant’s own sandboxed instance, its port is not on the internet, updates are tested on our own agents first, and the dashboard shows the activity feed and the restart button rather than the log directory. Hosted OpenClaw on Diali is the page for that; the runtime underneath is the same one the docs describe.

If you run it yourself

• Keep it on loopback and tunnel in; expose it only behind a shared secret.
• Learn the five-command ladder before you need it.
• Back up the state directory; the Gateway owns it.

And read the heartbeat guide before you wonder why the Gateway spent money while you slept.