The OpenClaw dashboard (Control UI): what it is and how to open it
OpenClaw ships a web dashboard for chatting with and managing your agent. Where it lives, how sign-in works, and how to reach it safely from anywhere.
The dashboard (OpenClaw calls it the Control UI) is the web interface to your agent: chat, sessions, skills, automations, and settings in one place. openclaw dashboard opens it; by default it’s served by the Gateway at http://127.0.0.1:18789/ on the machine the agent runs on, reachable only from that machine, which is the safe default doing its job.
What’s actually in it
The Control UI is a window onto the Gateway, not a separate system. OpenClaw 2 (2026.8.1, August 31, 2026) rebuilt it, with conversation search and branches, and today you get:
- Chat: a full conversation surface with your agent, useful even if you do your daily talking in Telegram or WhatsApp.
- Sessions: the running contexts of your conversations, inspectable per channel and sender.
- Skills: what your agent can do, and what each skill still needs (keys, dependencies) before it works.
- Automations: the scheduled jobs, the standing work your agent does without being asked.
- Panels: a terminal on the agent’s machine and a view of the browser it drives, beside the chat.
- Overview and settings: status, model config, channels, and how the Gateway is being reached (it will tell you, for instance, when you’re authenticated via a trusted proxy).
It is no longer the only window. OpenClaw’s desktop apps for macOS, Windows and Linux and its iPhone and Android apps (on the App Store and Google Play) connect to the same Gateway and show the same agent.
Opening it, and how sign-in works
On the machine running OpenClaw: openclaw dashboard opens your browser at the Gateway’s address, http://127.0.0.1:18789/ by default. What happens next depends on your setup:
- Token sign-in. Setups like the official Docker flow generate a Gateway token (written to
.env) that you paste on first visit. - Device pairing. New browsers may need a one-time device approval (
openclaw devices approve) before they get full access, an intentional second gate, so a leaked URL alone doesn’t equal control of your agent.
Reaching it when you’re not at the machine
Here’s where every OpenClaw operator eventually lands: the dashboard lives on loopback, your agent lives on a server, and you want the dashboard, or OpenClaw’s phone app, on your phone. The wrong answer is binding the Gateway to a public interface: that’s the one mistake with no safe version. The right answers, in rising order of polish: do your daily talking through chat channels (they need no exposed ports at all), use an SSH tunnel when you administer the box anyway, join the server and your phone in a private Tailscale network with Tailscale Serve (the route OpenClaw’s own docs prefer), or put an identity-checking proxy in front of the private Gateway so you sign in with your own identity from anywhere. Everpod’s OpenClaw pod arrives with that solved: your agent’s native dashboard on any device, behind your email sign-in, with no Gateway port on the internet.