Make your gateway reachable

Vox connects to your OpenClaw gateway from the Vox cloud, not from your phone or Mac. So the gateway needs an address that works from anywhere on the internet. Vox needs two things:


Gateway URL	A `wss://` address that reaches your gateway from the public internet.
Password	Your gateway’s password. The gateway must use password auth.

This page shows three ways to get that address. They all end the same way: a wss:// URL and a password that you paste into Vox.

	Best when	You need
Tailscale Funnel	You already use Tailscale	A tailnet with MagicDNS and HTTPS on
Reverse proxy	Your gateway runs on a VPS	Ports 80 and 443 open, and a domain or a free `sslip.io` name
Cloudflare Tunnel	You have a domain on Cloudflare	No open ports at all

Don’t have OpenClaw yet? See Get OpenClaw running. Already have a public wss:// address? Skip ahead to Connect Vox.

Before you start

These apply to every option.

Keep the gateway on loopback. Set gateway.bind to "loopback". Funnel, your proxy, or the tunnel is the only way in. Never open the gateway’s own port (18789 by default) to the internet.
Use password auth with a long random password. Generate one on the gateway’s machine:
openssl rand -hex 32
OpenClaw suggests keeping it in the OPENCLAW_GATEWAY_PASSWORD environment variable rather than in the config file.
Use wss://, never ws://. OpenClaw only allows plain ws:// on private networks, and Vox connects over the internet.

OpenClaw covers these rules in depth in Network exposure and Remote access.

Option 1: Tailscale Funnel

Funnel publishes your gateway on your machine’s Tailscale name, and Tailscale handles the certificate. OpenClaw sets it up for you. In your OpenClaw config:

{
  gateway: {
    bind: "loopback",
    tailscale: { mode: "funnel" },
    auth: { mode: "password", password: "your-long-random-password" },
  },
}

Restart the gateway. Your URL is your machine’s Tailscale name, for example wss://your-machine.your-tailnet.ts.net. Funnel needs Tailscale 1.38.3 or later, with MagicDNS and HTTPS turned on for your tailnet. OpenClaw refuses to start Funnel unless auth mode is password. See OpenClaw’s Tailscale guide for the full list.

Funnel only works while Tailscale’s public DNS serves your machine’s name. If Tailscale has an outage, Vox can’t reach your gateway until it’s fixed. If you need Vox to keep working through one, use one of the other options.

Option 2: A reverse proxy on your server

If your gateway runs on a VPS, a reverse proxy such as Caddy gives it a public HTTPS address with a free Let’s Encrypt certificate. The gateway stays on loopback and Caddy forwards to it.

Pick a hostname

Point a domain you own at the server’s public IP, for example openclaw.example.com. No domain? Use your IP as an sslip.io name. For the IP 203.0.113.10, that’s 203-0-113-10.sslip.io, which works with no setup.

Open ports 80 and 443

Caddy needs both: 80 to get the certificate and 443 to serve it. On cloud hosts (Oracle, AWS, Google Cloud), open them in the provider’s firewall or security list as well as on the server.

Configure Caddy

In your Caddyfile:

openclaw.example.com {
    reverse_proxy 127.0.0.1:18789
}

Reload Caddy. It gets the certificate on its own and passes WebSocket connections through.

Tell the gateway about the proxy

In your OpenClaw config:

{
  gateway: {
    bind: "loopback",
    publicOrigin: "https://openclaw.example.com",
    trustedProxies: ["127.0.0.1", "::1"],
    auth: { mode: "password", password: "your-long-random-password" },
  },
}

trustedProxies lets the gateway accept connections that Caddy forwards from the same machine. publicOrigin is the address the gateway expects connections to come from. Both use your hostname exactly. Restart the gateway.

Your URL is wss:// plus your hostname, for example wss://openclaw.example.com. Using nginx or Traefik instead? The gateway settings are the same. Make sure the proxy replaces the X-Forwarded-For header instead of appending to it. OpenClaw shows the right nginx lines in Reverse proxy configuration.

Option 3: Cloudflare Tunnel

With Cloudflare Tunnel, the cloudflared service on your server dials out to Cloudflare, so you don’t open any ports. You need a domain on Cloudflare.

Create the tunnel

Install cloudflared on the gateway’s machine, create a tunnel, and route a hostname such as openclaw.example.com to it. Cloudflare’s Tunnel docs walk through it.

Point the tunnel at the gateway

In the tunnel’s config:

tunnel: <tunnel-id>
credentials-file: /root/.cloudflared/<tunnel-id>.json
ingress:
  - hostname: openclaw.example.com
    service: http://localhost:18789
  - service: http_status:404

Tell the gateway about the tunnel

Use the same gateway settings as for a reverse proxy, with your tunnel’s hostname:

{
  gateway: {
    bind: "loopback",
    publicOrigin: "https://openclaw.example.com",
    trustedProxies: ["127.0.0.1", "::1"],
    auth: { mode: "password", password: "your-long-random-password" },
  },
}

Restart the gateway.

Your URL is wss://openclaw.example.com.

Vox can’t connect through Cloudflare Access yet. OpenClaw’s Cloudflare Tunnel and Access guide puts Access in front of the gateway and switches it to trusted-proxy auth, and Vox needs password auth. For now, don’t put an Access policy on the hostname Vox uses. The gateway password still protects it.

Check it from outside

Before connecting Vox, open your address with https:// in front, for example https://openclaw.example.com, in a browser on a different network, such as your phone on cellular. If the page loads, Vox can reach your gateway too.

Connect Vox

Paste the URL and password into Vox, then approve Vox once on your gateway. Connect Vox to OpenClaw walks through it. Vox accepts the https:// form of your address and switches it to wss://. If you move your gateway to a new address later, update it in Settings › Sessions. The gateway treats the new address as a new connection, so approve Vox on it again.

Troubleshooting

The address doesn't load from outside

The name doesn’t reach the internet. With Funnel, check that Funnel is on and that your tailnet has MagicDNS and HTTPS on. A Tailscale DNS outage also causes this. With a reverse proxy, check that the hostname points at your server and that ports 80 and 443 are open in the cloud firewall. With a tunnel, check that cloudflared is running.

Origin not allowed

The gateway rejected the address Vox connected from. Set gateway.publicOrigin to your address with https://, for example https://openclaw.example.com. If you set gateway.controlUi.allowedOrigins, add the same address there, because an explicit list replaces publicOrigin.

Proxy attribution required

Your proxy or tunnel runs on the same machine as the gateway, and the gateway doesn’t trust it yet. Add gateway.trustedProxies: ["127.0.0.1", "::1"] and restart the gateway.

Wrong password

Check for typos, and that the gateway uses gateway.auth.mode: "password". Funnel requires it, and Vox only supports it.

Blocked by Cloudflare Access

Vox can’t sign in through Cloudflare Access yet. Remove the Access policy from the hostname Vox uses.

Getting started

Using Vox

Vox with other apps

Make your gateway reachable

Before you start

Option 1: Tailscale Funnel

Option 2: A reverse proxy on your server

Option 3: Cloudflare Tunnel

Check it from outside

Connect Vox

Troubleshooting