Console

Console provides a browser-based terminal to your cloud-deployed OpenClaw instances. Traffic routes through a Tailscale mesh — no public SSH ports, no VPN setup, no firewall rules to manage.

Overview

Every cloud instance joins a private Tailscale tailnet during provisioning. The Clawkeeper dashboard acts as the gateway: when you click Open Console, the dashboard issues a signed JWT, opens a proxied connection through Tailscale, and streams the terminal session to your browser.

The instance has no public-facing ports for shell access. Port 22 (SSH) is blocked by UFW. The only path to the terminal is through the authenticated console proxy.

How it works

1. You click Open Console on a cloud instance's host detail page.
2. The dashboard verifies your session, org membership, and plan tier.
3. A short-lived JWT is minted with your user ID, org ID, and instance slug.
4. The browser opens a WebSocket to the console proxy endpoint.
5. The proxy validates the JWT, resolves the instance's Tailscale IP, and opens a connection over the mesh.
6. Terminal I/O is streamed bidirectionally — you interact with the instance as if you were at the keyboard.

Security model

Network isolation

• UFW blocks all inbound ports except 80 (HTTP redirect) and 443 (Tailscale HTTPS).
• Port 22 (SSH) is explicitly denied after cloud-init completes.
• Tailscale provides WireGuard-encrypted connectivity between the proxy and the instance. Traffic never crosses the public internet.

Authentication

• JWT tokens are signed with CONSOLE_JWT_SECRET using HS256.
• Tokens include sub (user ID), org (org ID), slug (instance console slug), and exp (1-hour expiry).
• The proxy rejects expired, malformed, or incorrectly signed tokens.

Authorization

• The user must belong to the organization that owns the instance.
• The organization must be on a Pro, Team, or Enterprise plan.
• The instance must be in ready status with a valid console_slug.

Tailscale ACLs

The tailnet is configured with ACLs that restrict traffic to the console proxy server. Individual instances cannot initiate outbound connections to other nodes on the mesh.

Requirements

For the console button to appear and function:

Troubleshooting

Console button is greyed out

The instance is not in ready status. Check the instance detail page for provisioning progress or errors. If the instance is stopped, start it first.

"Unauthorized" error when opening Console

Your session may have expired, or you are not a member of the owning organization. Log out and log back in, then retry.

Console connects but shows a blank screen

The Tailscale daemon on the instance may not be running. Try Redeploy from the instance detail page to re-provision with a fresh Tailscale node.

Latency or disconnects

Console sessions route through the nearest Tailscale relay (DERP). If you experience high latency, check that your instance region is geographically close to you. Idle sessions may disconnect after 30 minutes.

Environment variables

These server-side variables configure the console proxy. Set them in your Vercel (or hosting) environment: