Safety & Cost Control

Close the Exposed Admin Port 8080

For Docker Deployments

Always bind to localhost only in your '<'code'>'docker-compose.yml'<'/code'>':

ports:
  - "127.0.0.1:8080:8080"  # Safe: localhost only
  # NOT: "8080:8080"       # Dangerous: exposed to all interfaces

Firewall Rules (Linux)

# Block external access to port 8080
sudo ufw deny from any to any port 8080

# Or with iptables
sudo iptables -A INPUT -p tcp --dport 8080 -j DROP
sudo iptables -A INPUT -p tcp -s 127.0.0.1 --dport 8080 -j ACCEPT

Run the Security Audit

OpenClaw includes a built-in security scanner:

# Check for common misconfigurations
moltbot security audit

# Auto-fix safe issues
moltbot security audit --fix

The '<'code'>'--fix'<'/code'>' flag will: tighten '<'code'>'groupPolicy="open"'<'/code'>' to '<'code'>'groupPolicy="allowlist"'<'/code'>', and enable sensitive logging redaction.

Encrypting Your config.json Credentials

OpenClaw stores credentials in plaintext under '<'code'>'~/.clawdbot/'<'/code'>'. For production:

Option 1: Use Environment Variables

# .env file (add to .gitignore!)
ANTHROPIC_API_KEY=sk-ant-xxx
OPENAI_API_KEY=sk-xxx
TELEGRAM_BOT_TOKEN=123456:ABC...

# Reference in config or pass to Docker

Option 2: File System Encryption

# macOS: Enable FileVault (System Preferences > Security & Privacy)

# Linux: Use encrypted home directory or LUKS
# Or encrypt just the credentials directory:
encfs ~/.clawdbot-encrypted ~/.clawdbot

Rotate Keys Regularly

If you suspect exposure:

1. Revoke/regenerate keys in the provider dashboard (Anthropic, OpenAI, Telegram BotFather)
2. Update '<'code'>'~/.clawdbot/credentials/'<'/code'>' or your environment variables
3. Restart the gateway: '<'code'>'openclaw gateway restart'<'/code'>'

Context Pruning: Use max_tokens

Large context windows = large bills. Configure token limits to prevent runaway costs:

// In your moltbot config or agent settings:
{
  "model": {
    "max_tokens": 4096,          // Limit output tokens
    "max_context_tokens": 32000  // Limit context window
  }
}

Enable Cache Pruning

OpenClaw supports automatic context pruning when cache TTL expires:

// Enable cache-TTL pruning to reduce cache write costs
{
  "cache": {
    "enabled": true,
    "ttl": "5m",           // Cache TTL
    "prune_on_expire": true // Prune context when cache expires
  }
}

Heartbeat to Keep Cache Warm

For Anthropic, cache reads are 10x cheaper than input tokens. Set heartbeat interval just under the cache TTL:

// If cache TTL is 1 hour, use 55-minute heartbeat
{
  "heartbeat": {
    "enabled": true,
    "interval": "55m"
  }
}

Switch to Cheaper Models

Not every task needs Claude Opus. Use tiered models based on task complexity:

Configure Model Routing

// Route simple tasks to cheaper models
{
  "routing": {
    "default": "claude-3-5-haiku",      // Default to cheapest
    "complex": "claude-3-5-sonnet",     // Upgrade for complex tasks
    "reasoning": "claude-3-5-opus"      // Only when needed
  }
}

Use Anthropic Batch API

For non-urgent tasks, the Batch API offers '<'strong'>'50% discount'<'/strong'>':

// Enable batch processing for background tasks
{
  "batch": {
    "enabled": true,
    "queue_threshold": 10,  // Batch when 10+ messages queued
    "max_wait": "30s"       // Or after 30 seconds
  }
}

Set Up Cost Alerts

Monitor spending before it gets out of control:

Anthropic Console

1. Go to '<'a href="https://console.anthropic.com" target="_blank" rel="noopener noreferrer"'>'console.anthropic.com'<'/a'>'
2. Navigate to Usage & Limits
3. Set a monthly spending limit
4. Enable email alerts at 50%, 80%, 100% thresholds

OpenAI Dashboard

1. Go to '<'a href="https://platform.openai.com" target="_blank" rel="noopener noreferrer"'>'platform.openai.com'<'/a'>'
2. Settings → Limits
3. Set hard usage cap