Self-host an AI agent gateway
openclaw-rs is a self-hosted AI gateway: an axum JSON-RPC server with auth, rate limiting, encrypted credentials, and an embedded dashboard — MIT-licensed, on your own box.
- Managed agent platforms mean your credentials and session data live on someone else's servers.
- You need auth, rate limiting, and encrypted secrets without stitching together services.
- You want a dashboard without deploying a separate admin app.
- One gateway binary
- openclaw-gateway is an axum HTTP + WebSocket JSON-RPC 2.0 server with per-client rate limiting, auth middleware, and CORS — all in the single openclaw binary.
- Encrypted credentials
- The AES-256-GCM credential store uses Argon2id key derivation, 0600 file permissions, and automatic redaction in logs (ApiKey prints [REDACTED]).
- Dashboard included
- openclaw-ui is a Vue 3 app the gateway serves at / — no separate admin server to deploy.
If you want to own your AI infrastructure end to end, openclaw-rs is a
self-hosted gateway you run on your own hardware. openclaw-gateway is an
axum HTTP and WebSocket server that speaks JSON-RPC 2.0, with per-client rate
limiting, auth middleware, and CORS built in. It exposes the full method set —
session.create, session.message, session.history, session.end,
agent.list, agent.status, tools.list, tools.execute.
Credentials never leave the box. The AES-256-GCM credential store derives its
key with Argon2id, writes with 0600 permissions, and redacts secrets in logs so
an ApiKey always prints [REDACTED]. And because openclaw-ui — a Vue 3
dashboard — is embedded into the gateway and served at /, there is no
separate admin service to stand up.
The whole thing is MIT-licensed and ships as a single static binary. See the architecture for how the gateway composes the runtime, and the security page for the encryption and validation model.
How it works, step by step
- 1 Install on your server
cargo install openclaw-cli on the host you control.
- 2 Onboard and store secrets
openclaw onboard writes provider credentials into the AES-256-GCM store.
- 3 Run the gateway
openclaw gateway run exposes the JSON-RPC 2.0 API with auth, rate limiting, and CORS.
- 4 Open the dashboard
Browse to / — the gateway serves the embedded Vue 3 dashboard directly.
FAQ
- Do I need a separate admin app for the dashboard?
- No. openclaw-ui is a Vue 3 app embedded into openclaw-gateway and served at /. One binary gives you the gateway and the dashboard.
- How are API keys stored?
- In an AES-256-GCM credential store with Argon2id key derivation and 0600 file permissions. Keys are redacted in logs — ApiKey prints [REDACTED].