Deploy and Host self hosted OpenClaw Pairing (Open-Source AI Assistant) on Railway

Deploys an OpenClaw gateway where pairing gates access: approve unknown DM senders via 8-character codes and approve each browser or phone once.

About Hosting OpenClaw Pairing open-source software on Railway (self hosted OpenClaw template)

This template keeps pairing data yours: approval codes, device allowlists, and the SQLite state live on the /data volume, not a third-party panel. You own every approval decision.

Why Deploy OpenClaw Pairing, the ChatGPT alternative on Railway (Railway Free Trial)

ChatGPT locks you into OpenAI's servers and per-seat pricing. The $5 trial covers a month of that control; after that you pay $10-25/mo for the container instead of a per-user SaaS bill.

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying OpenClaw Pairing on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Railway vs Other Hosting Providers and VPS for OpenClaw Pairing self hosting

Railway gives you a managed gateway with the pairing database on a persistent volume, while a raw VPS means you maintain that state yourself.

Provider	What You Get with Railway	What You Get with the Other Provider
DigitalOcean	One-click deploy, persistent /data volume, device approval	You run the Docker image on a droplet and manage pairing state manually
AWS	Railway handles port, health checks, SQLite volume	EC2 or ECS means VPC, IAM, and volume setup before pairing works
Hetzner	No server admin, pairing requests in the Control UI	Cheap bare metal, but you install Node and secure the UI
Railway's managed volume beats a bare VPS for pairing.

Common Use Cases for hosted OpenClaw Pairing

Family Telegram bot: Approve each family member once by their 8-character code, then the bot only ever runs tools for people you actually know. Nobody else's DM gets processed.
WhatsApp number shared with a small team: Pair every colleague's number individually before the assistant will answer, so a leaked number doesn't hand strangers shell access through your gateway.
Discord server bot with DMs locked: Keep group commands off but pair the few moderators who may DM the bot. Unknown server members just get a code and silence until you approve.
First browser after deploy: The very first Control UI session from a new IP shows as a device request. Approve it once with openclaw devices approve before anyone can touch settings.
Removing a sender: Dismiss a pending DM request from the Control UI or CLI, and that account's message never runs a tool. Pairing state lives in the SQLite file, so the rejection sticks across restarts.

Dependencies for OpenClaw Pairing Docker hosted on Railway

Hosting OpenClaw Pairing on Railway needs one container, a /data volume, and a few env vars. Pairing approvals live in SQLite under /data/.openclaw, so that volume is essential to keep DM approvals and device pairings across restarts.

Deployment Dependencies for Managed OpenClaw Pairing Service (AI Assistant Gateway)

The service runs on port 18789 with /healthz. Railway generates a 48-char OPENCLAW_GATEWAY_TOKEN. No model key is required at boot; add one later in Settings.

Implementation Details for OpenClaw Pairing (Using OpenClaw official docker image)

The start command chowns /data as the node user, applies OPENCLAW_RAILWAY_CONFIG (one-line JSON setting gateway.mode local, publicOrigin and allowedOrigins from RAILWAY_PUBLIC_DOMAIN, and Railway's 100.64.0.0/10 trusted proxy), then runs openclaw gateway --bind lan --port 18789 --allow-unconfigured.

How does OpenClaw Pairing compare against other AI assistant gateways

OpenClaw vs Hermes Agent

Self-hosting: Both MIT, but OpenClaw adds DM pairing and device approval; Hermes is a Python agent loop.
Access control: OpenClaw's 8-character codes gate senders before tools run; Hermes lacks built-in pairing.
Language: Hermes is Python, OpenClaw is Node/TS; pick your team's stack.

OpenClaw vs ChatGPT

Hosting: ChatGPT is closed SaaS with no self-hosting or DM pairing; OpenClaw runs on Railway and gates unknown senders.
Ops: ChatGPT needs zero upkeep but no sender control; OpenClaw makes you approve each DM, safer for tool-running.
Tools: OpenClaw runs commands in your container, so pairing matters; ChatGPT's tools stay on OpenAI's side.

OpenClaw vs n8n AI agents

Focus: n8n is visual workflow automation, not a chat gateway; you'd build and secure channels yourself. OpenClaw includes pairing.
Pairing: n8n has no built-in DM pairing or device approval; OpenClaw blocks unknown senders before any tool runs.
Extensibility: n8n wins on drag-and-drop connectors; OpenClaw wins on multi-channel assistant with approval controls.

OpenClaw vs Open WebUI

Scope: Open WebUI is a chat UI for local models, no multi-channel gateway or DM pairing; OpenClaw connects Telegram, WhatsApp, Discord with codes.
Interface: Open WebUI has a polished web chat; OpenClaw's Control UI focuses on pairing requests and channel config.
Security: Open WebUI uses web app auth but no 8-character codes for unknown senders; OpenClaw pairs before tools run.

How to use OpenClaw Pairing (the OSS AI assistant)?

Open the Railway-assigned public domain.
Paste OPENCLAW_GATEWAY_TOKEN into Control UI settings.
Approve your browser in the Railway service shell:

openclaw devices approve

Add a model provider key under Settings Models.
Connect Telegram with TELEGRAM_BOT_TOKEN.
Message the bot from your account. Note the 8-character uppercase code it sends; pending requests cap at 3 per channel account.
Approve the sender:

openclaw pairing approve telegram CODE

Or approve in Settings Channels DM access requests.

Message from a second account to confirm it is held for pairing.

How to self host OpenClaw Pairing on other VPS Services (OpenClaw self hosting guide)

Clone the Repository

OpenClaw's source is MIT licensed. Clone it or skip to the installer script:

git clone https://github.com/openclaw/openclaw.git

Then cd into the repo.

Install Dependencies

Use Node 24.16+ or 26.1+. Install globally:

npm install -g openclaw@latest

Or run the installer:

curl -fsSL https://openclaw.ai/install.sh | bash

Then run openclaw onboard --install-daemon.

Configure Environment Variables

Set your gateway token and a channel. For Telegram:

export OPENCLAW_GATEWAY_TOKEN=your-token
export TELEGRAM_BOT_TOKEN=your-telegram-token
# DM policy is set in the OpenClaw config, not an env var

Pairing stays on by default for DMs, so unknown senders get an 8-character code.

Start the OpenClaw Pairing Application

Launch the gateway with pairing active:

openclaw gateway --bind lan --port 18789 --allow-unconfigured

Approve your first browser with openclaw devices approve, then senders with openclaw pairing approve telegram CODE. Railway handles the container, volume, and proxy for you.

Official Pricing of OpenClaw Pairing (OpenClaw pricing)

OpenClaw Pairing is free, open-source software under the MIT license; no paid plan exists for the pairing controls themselves. Railway's $5 trial covers a short test run before you commit.

OpenClaw Pairing cloud vs self hosted comparison (Pricing, features, costs, and more)

Self hosting OpenClaw Pairing means you own the pairing state, the SQLite database, and every approval decision.

Monthly cost of self hosting OpenClaw Pairing on Railway

On Railway, expect roughly $10-25 per month. Model API costs are separate and depend entirely on usage. The core gateway without Chromium can run lighter, but if you want the browser tools you'll be at the higher end of that range.

System Requirements for Hosting OpenClaw Pairing on a VPS

For a VPS outside Railway, the main constraint is memory: 1-2 GB of RAM if you use the browser variant, less for the plain gateway. You need Node 24.16+ or 26.1+ for the npm install path, or Docker for the official image.

Frequently Asked Questions (FAQs)

Why does the bot reply with an 8-character code when a new person messages it?

That's DM pairing. An unknown sender is not processed until you approve the code, so random accounts cannot trigger tools or consume model credits. The code is sent once per request and you approve it in the Control UI or CLI.

How long do pairing codes last?

One hour, and they expire silently. Pending requests are capped at three per channel account, so old codes get pushed out when new senders arrive.

Can I approve senders without opening the CLI?

Yes. In the Control UI, go to Settings, Channels, DM access requests, filter by channel, then Approve or Dismiss. No shell needed for day-to-day pairing.

Does approving a DM also let that sender use the bot in groups?

No. DM approval only grants direct message access. Group commands follow separate groupAllowFrom and group allowlist rules, so you approve group access independently.

How do I dismiss a pairing request without blocking the sender permanently?

Use Dismiss in Settings, Channels, DM access requests. It just removes that pending code and does not block the sender; they can request again later.

Where is pairing data stored?

In the SQLite database under the OpenClaw state directory, which on this Railway template is the /data volume at /data/.openclaw/state/openclaw.sqlite. Back up that volume to keep your approved senders and devices.