DEV Community

OpenClaw Cash
OpenClaw Cash

Posted on Originally published at openclawcash.com

Self-host an agent, then give it a wallet that cannot drain

#agents #tutorial #api #security

Most self-hosted agent setups fail in the same few places, and none of them are the interesting part of the work. People install on a dirty machine, run everything as root, expose a dashboard to the internet before testing it locally, mix local and remote env files, add skills before the base install is healthy, paste an API key that carries a trailing space, and never write down how to get back.

This is the order that avoids all of it: host first, health second, skill third, money last. By the end you have a host that survives a reboot and an agent wallet with a daily cap you can read back over the API.

Pick the host model before you install anything

Three practical options, and the prep step differs for each.

  • Mac mini or any always-on box at home. Fastest to iterate, local control. Power and internet interruptions are your responsibility.
  • Ubuntu VPS. The default for most people: always on, snapshots, a straight path to firewall and reverse proxy.
  • Dedicated Ubuntu server. Full control over performance and networking, more operational overhead, slower to get right if you are new.

Whichever you pick, the machine stays up and you can reach it over SSH when it is remote.

Step 1: Prepare the machine as a normal user

Create a non-root user for runtime work, enable key-based SSH, disable password login, and turn the firewall on with an explicit allow list.

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl git ca-certificates ufw
sudo ufw allow OpenSSH
sudo ufw enable
Enter fullscreen mode Exit fullscreen mode

Then confirm the things that quietly break auth and TLS an hour later:

id
whoami
timedatectl status
hostnamectl
ip a
ufw status verbose
Enter fullscreen mode Exit fullscreen mode

If the system clock is off, fix it before you install anything: token signing and TLS both depend on it. On a VPS, check that the provider firewall matches the OS firewall, because two firewalls that disagree produce a bug report nobody can reproduce.

Step 2: Install, and read the health output before touching skills

Install with the official installer, run onboarding with the daemon, then run the diagnostics instead of assuming they passed.

which openclaw
openclaw --version
openclaw doctor
openclaw status
Enter fullscreen mode Exit fullscreen mode

Continue only when doctor reports a healthy baseline and the dashboard is stable after a refresh. If the dashboard fails intermittently now, a skill will not fix it, it will hide it. Before you expose the host to real traffic, put it behind a reverse proxy with TLS.

Step 3: Install the wallet skill the current way

Ask the agent whether it already has the OpenClawCash skill. If it does, read its SKILL.md and use the bundled scripts: nothing needs to be cloned or downloaded. If it does not, install it from your client's marketplace or catalog, or from the source repository:

git clone https://github.com/openclawcash/agentwalletapi <your-workspace>/skills/agentwalletapi
Enter fullscreen mode Exit fullscreen mode

MCP clients get a different package, the OpenClawCash MCP server at https://openclawcash.com/mcp. The published skill metadata, including the current version and install instructions, is at https://openclawcash.com/api/public/agentwalletapi/skill/latest.

Step 4: One key, then the read path before the write path

The skill needs exactly one required value, the API key:

AGENTWALLETAPI_KEY=occ_xxxxxxxxxxxxxxxxxxxxxxxx
Enter fullscreen mode Exit fullscreen mode

Now prove the read path with two calls that move no money:

BASE_URL=https://openclawcash.com

curl ${BASE_URL}/api/agent/wallets \
  -H "X-Agent-Key: occ_your_api_key"

curl "${BASE_URL}/api/agent/wallets?includeBalances=true" \
  -H "X-Agent-Key: occ_your_api_key"
Enter fullscreen mode Exit fullscreen mode

The first is discovery only: wallet id, label, address, network, chain. The second adds native balance and native symbol per wallet. A 401 here almost always means the key is wrong or carries whitespace, not that the network is broken.

Step 5: Confirm the cap before the first transfer

A wallet with no daily limit is the failure this entire post exists to prevent. Set the spending limit on the wallet in the dashboard, then read it back from the agent side:

curl ${BASE_URL}/api/agent/policies \
  -H "X-Agent-Key: occ_your_api_key"
Enter fullscreen mode Exit fullscreen mode

Spending limit policies come back hydrated with current usage:

{
  "type": "daily_spending_limit",
  "config": { "amount": "100" },
  "usage": { "spent": "45.00", "limit": "100.00", "symbol": "USD", "decimals": 2, "window": "24h" }
}
Enter fullscreen mode Exit fullscreen mode

If that list is empty for the wallet your agent is about to use, stop and set the limit. Once it is set, spent against limit is also the number worth putting on a chart: a limit the agent quietly exhausted shows up there before the retries start.

For the record on how the two halves split: in the published agent API surface, policies are read (GET /api/agent/policies and GET /api/agent/policy). They are created in the dashboard.

What is still rough

The API is a read surface for policies today, so a team that wants policy changes reviewed in code has to keep that step manual, or drive the dashboard. That is the honest state of it, and it is the step most likely to be skipped, which is why it is the one to write down in your runbook.

Everything above is on the setup page of the source article, rewritten here for the order that fails least: https://openclawcash.com/blog/openclaw-setup-tutorial-for-agent-first-users

Endpoint reference: https://openclawcash.com/docs

Top comments (0)