Authentication and Access Control

How Authentication Works in ClawHosters

ClawHosters uses different authentication methods depending on what you are accessing. Your dashboard, your instance's web UI, connected chat channels, the API, and SSH each have their own authentication mechanism.

This page explains each method, how credentials are managed, and what each one protects.

Gateway Authentication (Instance Web UI)

When you access your OpenClaw instance through a web browser on port 8080, the gateway uses HTTP basic authentication. The browser will prompt you for a username and password.

The password is generated automatically when your instance is created. You can view it in your instance dashboard under the connection details section. If you need a new password, you can regenerate it from the instance settings.

HTTP basic auth protects the gateway web interface. Every browser session requires these credentials. The password is stored as a SHA256 hash on the instance, not in plain text.

Channel Pairing (Telegram, WhatsApp, Discord)

Chat channels connect to your instance through a pairing flow. This is a one-time process per channel.

How pairing works:

1. Open your instance dashboard and go to the Channels section
2. Click "Generate Pairing Code" for the channel type you want to connect
3. The dashboard shows a short-lived pairing code
4. Send the pairing code as a message in the chat (Telegram group, WhatsApp chat, or Discord channel)
5. Your instance confirms the pairing and the channel is linked

Once paired, the channel stays connected until you explicitly unpair it. The pairing code expires after a few minutes if unused.

Each channel type has its own pairing flow, but the principle is the same: generate a code on the dashboard, enter it in the chat. No API keys or bot tokens are required from your side for Telegram and WhatsApp channels, as these are handled by the ClawHosters infrastructure.

Dashboard Authentication

The ClawHosters dashboard (clawhosters.com) uses standard email and password authentication.

When you create a ClawHosters account, your password is hashed with bcrypt before storage. The original password is never stored. Sessions are maintained via secure cookies and expire automatically after a period of inactivity.

You can change your password at any time from your account settings.

API Token Authentication

The ClawHosters API uses Bearer token authentication. API tokens have the prefix oc_live_ and are passed in the Authorization header of each request.

Authorization: Bearer oc_live_your_token_here

You can generate and revoke API tokens from your dashboard. Each token has full access to your account's resources. Treat API tokens like passwords, as anyone with a valid token can manage your instances and billing.

For full details on the API, including available endpoints, request formats, and error codes, see the API Overview.

SSH Access Authentication

SSH access to your instance's VPS uses key-based authentication. Password-based SSH login is disabled.

To enable SSH access, you upload your public SSH key through the instance dashboard. Once enabled, you can connect as root using your private key.

Important: Enabling SSH access permanently marks your instance as "No Support." This is a one-way action.

For the full SSH setup process, security implications, and connection instructions, see SSH Access to Your Instance.

Access Control Summary

Credential Management Tips

• Gateway password: Regenerate it from instance settings if you suspect it has been shared unintentionally
• API tokens: Revoke tokens you no longer use. Generate separate tokens for different integrations so you can revoke them individually
• SSH keys: Only upload keys you actively use. Remove old keys when rotating credentials
• Dashboard password: Use a strong, unique password. Consider using a password manager

Related Docs

• Security Overview -- Infrastructure, network, and container security measures
• API Overview -- Full API documentation with endpoints and examples
• SSH Access to Your Instance -- SSH setup, connection, and security implications