How to Deploy OpenClaw on DigitalOcean App Platform

OpenClaw is an open-source, MIT-licensed AI messaging gateway that routes conversations across WhatsApp, Telegram, Slack, Discord, Signal, and other channels. It supports any LLM backend, from Anthropic Claude and OpenAI GPT to local models via OpenRouter and Gradient.

DigitalOcean supports three distinct deployment methods, each targeting a different operational profile:

1-Click Marketplace Droplet: A pre-configured virtual machine with OpenClaw already installed, firewall rules set, and Docker sandboxing enabled. You SSH in, provide your LLM API key, and start chatting. The current marketplace image ships version 2026.5.6 on Ubuntu 24.04 with Node.js 22.

App Platform: A managed container runtime where you define agents declaratively in a YAML spec, push updates through Git, and let DigitalOcean handle restarts, scaling, and zero-downtime deploys. No SSH, no server patching, no firewall configuration.

Manual Docker on a Droplet: Full control over the OS, networking, and container orchestration. You pull the OpenClaw image, write your own Compose file, and manage everything yourself. This is the right choice when you need custom networking, specific kernel modules, or integration with existing infrastructure.

The rest of this guide focuses primarily on App Platform, since it fills the gap most deployment tutorials skip. We cover 1-Click and manual Docker where the comparison matters.

Picking the wrong deployment method creates unnecessary operational overhead. Here is how to choose based on team size, scaling needs, and maintenance tolerance.

1-Click Droplet works best for solo developers and small experiments. You get a running instance in under five minutes with a browser-based dashboard for configuration. The starting tier is $12/month. The tradeoff: scaling means resizing or adding Droplets manually, and you handle OS patches and updates yourself.

App Platform fits teams running multiple agents in production. You define your agents declaratively, push updates through Git, and DigitalOcean manages container restarts, logging, and zero-downtime deployments. Individual agents can be resized independently. Pricing starts around $12/month per worker and scales with the resources you allocate.

Manual Docker is for operators who need full control over networking, container orchestration, or OS-level configuration. The infrastructure cost matches a standard Droplet, but you take on all maintenance yourself.

The key tradeoffs come down to setup speed versus flexibility. The 1-Click Droplet gets you running fast but limits your scaling options. App Platform adds a few minutes of initial setup in exchange for managed infrastructure and git-driven deploys. Manual Docker takes the longest to configure but places no constraints on your architecture.

The App Platform deployment uses a template repository maintained by DigitalOcean at digitalocean-labs/openclaw-appplatform. This repository contains the deployment specification, container configuration, and documentation for all required settings.

Step 1: Fork the template repository

Start with DigitalOcean's official template. It includes the deployment spec and container setup you need. Forking gives you a copy you can customize and connect to App Platform's git-driven deploy pipeline.

Step 2: Configure your deployment

The repository README documents the required and optional environment variables. At minimum, you need credentials for your LLM provider and a gateway authentication token. Optional settings enable features like private networking, persistent backup to DigitalOcean Spaces, and tunnel-based dashboard access. Review the template's documentation for the full variable reference, since the available options evolve with each release.

Step 3: Deploy

You can deploy directly from the repository's "Deploy to DigitalOcean" button or through the DigitalOcean CLI. App Platform builds the container image, provisions a background worker (no public URL by default, which is a security advantage), and starts the OpenClaw gateway. The first build typically takes a few minutes.

Step 4: Verify the deployment

Use the App Platform dashboard's console tab or the DigitalOcean CLI to confirm the gateway is running and accepting connections. The template repository documents the specific health check commands for the current version.

Step 5: Connect messaging channels

Add your first messaging channel through OpenClaw's channel setup flow. WhatsApp uses QR code pairing, while Telegram, Discord, and Slack use bot tokens or OAuth. The gateway handles protocol translation between each channel and your LLM backend.

Give your OpenClaw agents persistent file storage

Fastio's Business Trial includes 50 GB storage, file versioning, and an MCP server your OpenClaw agents can call directly. No credit card, no expiration.

Start 14-Day Trial

App Platform containers are disposable by design. When a container restarts (due to a deploy, a crash, or a scaling event), any data written to the local filesystem disappears. For OpenClaw, that means channel sessions, agent configuration, and conversation history vanish unless you configure external persistence.

The official App Platform image solves this with Restic, an encrypted incremental backup tool that snapshots your OpenClaw data directory to DigitalOcean Spaces every 30 seconds. The backup covers /data/.openclaw (gateway config and channel sessions), Tailscale device state, and system configuration.

To enable Spaces backup, you provide your Spaces API credentials, a regional endpoint, a bucket name, and an encryption password through environment variables. The template repository's README documents the exact variable names and configuration options.

On container restart, Restic automatically restores the latest snapshot before OpenClaw starts. Retention policies keep storage costs predictable by pruning old snapshots on a schedule.

For teams that need more than ephemeral backup, consider pairing this with a dedicated workspace. Fastio's Business Trial provides 50 GB of persistent storage with file versioning, audit trails, and an MCP server that OpenClaw agents can use to read and write files across sessions. This separates your agent's working documents from its runtime state: Spaces handles the gateway config, Fastio handles the files your agents actually produce and share.

DigitalOcean's OpenClaw deployments include several security layers by default, though the specifics vary by method.

Gateway token authentication validates that requests to the OpenClaw gateway come from authorized users. This applies to all three deployment methods. Set a strong OPENCLAW_GATEWAY_TOKEN and rotate it periodically.

Docker container isolation means that when an agent crashes or behaves unexpectedly, the damage stays inside its container. The host filesystem remains untouched. This is especially important for agents with tool execution enabled, since a misconfigured agent with shell access could otherwise modify the server.

Firewall and rate limiting protect the 1-Click Droplet against brute-force attacks. Fail2ban monitors failed request logs and dynamically updates firewall rules. On App Platform, the container runs as a background worker with no inbound ports exposed to the internet, which eliminates an entire class of network attacks.

Non-root execution limits the blast radius of a compromised process. Both the 1-Click image and the App Platform container run OpenClaw under a dedicated user account, not root.

TLS via Caddy (1-Click only) provides automatic HTTPS with LetsEncrypt certificates, including support for IP-based TLS without a domain name. App Platform handles TLS at the platform level.

OpenClaw also exposes execution policies that control what agents can do on the host: network access, shell commands, and API calls. Each policy can be toggled independently through the gateway configuration. In production, restrict execution to only the capabilities each agent actually needs. Customer-facing chatbots, for example, should be limited to text generation with no system access.

The operational advantage of App Platform shows up when you move from one agent to several. On a Droplet, adding agents means either cramming more processes onto the same VM or provisioning and configuring new machines. On App Platform, you add another worker definition to your app.yaml and push.

Each agent can run at a different instance size. A lightweight FAQ bot might need only the minimum 1 vCPU / 2 GB container, while a research agent with tool execution and web browsing might need 4 vCPU / 8 GB. You resize individual workers without touching the others, and without downtime.

Git-driven deploys mean every configuration change goes through version control. When you update an agent's model provider, add a new messaging channel, or install a ClawHub skill, the change is a commit. Rolling back is a git revert and a push.

Monitoring comes from App Platform's built-in logging and OpenClaw's health check commands, which verify that the gateway process is running and that each connected messaging channel has an active session. The specific commands are documented in the template repository and in OpenClaw's CLI reference.

For file management across agents, local storage works for ephemeral scratch data, but anything that needs to persist between deploys or be shared across agents needs external storage. Options include DigitalOcean Spaces for raw object storage, a managed database for structured data, or a workspace platform like Fastio that adds versioning, permissions, semantic search through Intelligence Mode, and an MCP server your agents can call directly. The free tier covers 50 GB and included credits with no credit card required.

Skill installation works through ClawHub, OpenClaw's skill marketplace. Skills add capabilities like calendar integration, web search, code execution, and file processing. On App Platform, you can install skills as part of your container build process or through the console after deployment. Check the ClawHub documentation for the current installation workflow.