Deploy OpenClaw on AWS

Set up your own AI personal assistant in the cloud using AWS Lightsail with Telegram integration

OpenClaw is an open-source AI personal assistant that helps you manage tasks, answer questions, and automate workflows through messaging platforms. This guide walks you through deploying OpenClaw on AWS Lightsail and connecting it to Telegram.

What you’ll need

Before starting, make sure you have:

• An AWS account (free tier eligible for some services)
• A Telegram account
• An API key from either:
  • Anthropic (for Claude models)
  • OpenAI (for GPT models)

Cost overview

The recommended AWS Lightsail instance costs approximately $20/month for a 4GB RAM instance, which provides sufficient resources for running OpenClaw reliably.

Create your Lightsail instance

Step 1: Access AWS Lightsail

1. Sign in to the AWS Console
2. Search for “Lightsail” in the services search bar
3. Click Create instance

Step 2: Configure the instance

1. Select your instance location: Choose the AWS Region closest to you for better latency
2. Select a platform: Choose Linux/Unix
3. Select a blueprint: Choose OS Only → Ubuntu 24.04 LTS
4. Choose your instance plan: Select the $20 USD plan (4 GB RAM, 2 vCPUs, 80 GB SSD)
5. Name your instance: Enter a descriptive name like openclaw-server
6. Click Create instance

Wait for the instance status to show Running before proceeding.

Access your instance

You have two options for connecting to your server.

Option 1: Browser-based SSH (easiest)

1. In the Lightsail console, find your instance
2. Click the terminal icon or Connect using SSH
3. A browser-based terminal opens automatically

Option 2: SSH with keys (recommended for regular use)

1. In Lightsail, go to Account → SSH keys
2. Download your default key or create a new one
3. Save the .pem file securely on your computer
4. Set proper permissions and connect:

Terminal

chmod 400 ~/Downloads/your-key.pem
ssh -i ~/Downloads/your-key.pem ubuntu@YOUR_INSTANCE_IP

Replace YOUR_INSTANCE_IP with your instance’s public IP address (found in the Lightsail console).

Install dependencies

Once connected to your instance, update the system and install Node.js.

Update system packages

Terminal

sudo apt update && sudo apt upgrade -y

Install Node.js 22+

OpenClaw requires Node.js version 22 or higher. Install it using NodeSource:

Terminal

curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt install -y nodejs

Verify installation

Terminal

node --version
npm --version

You should see Node.js version 22.x.x or higher.

Install and configure OpenClaw

Install OpenClaw globally

Terminal

sudo npm install -g openclaw@latest

Run the onboarding wizard

OpenClaw includes an interactive setup wizard:

Terminal

openclaw onboard

The wizard guides you through:

• Choosing your AI provider (Anthropic or OpenAI)
• Entering your API key
• Configuring basic settings

Configure your AI provider

After onboarding, you can customize your configuration. Edit the config file:

Terminal

nano ~/.openclaw/openclaw.json

For Anthropic Claude

Anthropic configuration

{
  "ai": {
    "provider": "anthropic",
    "model": "claude-sonnet-4-20250514",
    "apiKey": "sk-ant-your-api-key-here"
  }
}

For OpenAI

OpenAI configuration

{
  "ai": {
    "provider": "openai",
    "model": "gpt-4o",
    "apiKey": "sk-your-api-key-here"
  }
}

Save the file with Ctrl+O, then exit with Ctrl+X.

Set up Telegram integration

Create a Telegram bot

1. Open Telegram and search for @BotFather
2. Start a chat and send /newbot
3. Follow the prompts to:
   • Choose a name for your bot (e.g., “My OpenClaw Assistant”)
   • Choose a username (must end in bot, e.g., myopenclaw_bot)
4. BotFather responds with your bot token - save this securely

Configure OpenClaw for Telegram

Add the Telegram channel to your OpenClaw configuration:

Terminal

nano ~/.openclaw/openclaw.json

Update the configuration to include Telegram:

Full configuration with Telegram

{
  "ai": {
    "provider": "anthropic",
    "model": "claude-sonnet-4-20250514",
    "apiKey": "sk-ant-your-api-key-here"
  },
  "channels": {
    "telegram": {
      "enabled": true,
      "token": "YOUR_TELEGRAM_BOT_TOKEN"
    }
  }
}

Replace YOUR_TELEGRAM_BOT_TOKEN with the token from BotFather.

Extend OpenClaw with skills

Skills extend OpenClaw’s capabilities with specialized functionality for onchain interactions.

Add Base skills with Bankr

The Bankr skills library provides onchain capabilities for Base, including trading, messaging, and DeFi automation.

Terminal

openclaw skills add https://github.com/BankrBot/openclaw-skills

Once installed, interact with Base through natural language:

Example conversations

You: "Swap 0.1 ETH for USDC on Base"
OpenClaw: "I'll swap 0.1 ETH for USDC on Base. Current rate: 1 ETH = 2,500 USDC. Proceed?"

Configure wallet access with openclaw config set wallet.privateKey "YOUR_KEY". Use a dedicated wallet with limited funds.

Enable self-learning for onchain actions

Create a skill that teaches OpenClaw to build its own skills when it learns new onchain patterns:

Terminal

mkdir -p ~/.openclaw/skills/skill-builder
nano ~/.openclaw/skills/skill-builder/SKILL.md

Add the skill definition:

SKILL.md

---
name: skill-builder
description: Create new OpenClaw skills from successful onchain actions
version: 1.0.0
---

# Skill Builder

Create new skills when you successfully complete onchain actions that could be reusable.

## When to create a skill

- You complete a multi-step onchain workflow successfully
- The user asks you to "remember how to do this"
- You discover a useful pattern for interacting with a smart contract

## How to create a skill

1. Identify the reusable pattern (contract addresses, function calls, parameters)
2. Create a new skill directory: `~/.openclaw/skills/<skill-name>/`
3. Write a SKILL.md file with name, description, instructions, and examples

## Skill template

\`\`\`markdown
---
name: <skill-name>
description: <what the skill does>
version: 1.0.0
chain: base
contracts:
  - address: <contract-address>
    name: <contract-name>
---

# <Skill Name>

## Usage
<How to invoke this skill>

## Steps
<Step-by-step instructions>
\`\`\`

Register the skill:

Terminal

openclaw skills add ~/.openclaw/skills/skill-builder

Now your agent creates new skills from successful onchain interactions:

Example

You: "Remember how to mint NFTs on that contract we just used"
OpenClaw: "Created skill: nft-minter-0x1234. You can now say 'mint an NFT' anytime."

Running OpenClaw

Start the agent

Run OpenClaw to start your assistant:

Terminal

openclaw start

OpenClaw connects to your configured channels (like Telegram) and starts listening for messages.

Test your setup

1. Open Telegram and find your bot
2. Send a message like “Hello!”
3. Your OpenClaw assistant should respond

Access the Gateway Dashboard

OpenClaw includes a Gateway Dashboard UI on port 18789 for monitoring and managing your agent. Since this port isn’t exposed publicly, use SSH tunneling to access it securely from your local machine.

Set up the tunnel:

Terminal

ssh -i ~/Downloads/your-key.pem -L 18789:localhost:18789 ubuntu@YOUR_INSTANCE_IP

This forwards port 18789 on your local machine to the server. While the SSH session is active, open your browser and navigate to:

http://localhost:18789

To run the tunnel in the background without an interactive shell, add the -N flag:

Terminal

ssh -i ~/Downloads/your-key.pem -L 18789:localhost:18789 -N ubuntu@YOUR_INSTANCE_IP

Ensure port 443 (HTTPS) is open for IPv4 in your Lightsail instance’s networking settings. In the Lightsail console, go to your instance → Networking → IPv4 Firewall and add a rule for HTTPS (port 443).

Security best practices

Configure the firewall

Enable and configure Ubuntu’s firewall (UFW):

Terminal

sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status

Protect your API keys

Your API keys are stored in ~/.openclaw/openclaw.json. Ensure proper permissions:

Terminal

chmod 600 ~/.openclaw/openclaw.json

Use SSH keys only

For enhanced security, disable password authentication:

1. Edit the SSH config:

Terminal

sudo nano /etc/ssh/sshd_config

2. Find and set:

sshd_config

PasswordAuthentication no

3. Restart SSH:

Terminal

sudo systemctl restart sshd

Make sure you can connect with your SSH key before disabling password authentication, or you may lock yourself out.

For more security recommendations, see the AWS Lightsail security best practices.

Resources

• OpenClaw GitHub repository
• OpenClaw documentation
• Bankr skills library
• AWS Lightsail documentation