OpenClaw Gateway Setup

# Install OpenClaw CLI (if not already installed)
curl -fsSL https://get.openclaw.ai | sh

# Start your OpenClaw gateway
openclaw gateway start

# Verify it's running (default port 18789)
openclaw gateway status

# 1. Open NervePay Dashboard > Integrations > Connect Gateway > "Pair" tab
# 2. A 6-character pairing code is generated automatically (e.g. ABC123)
# 3. Copy the code

# 4. On your gateway machine, run:
npx nervepay pair --code ABC123

# That's it! The command reads your gateway token from
# ~/.openclaw/openclaw.json automatically.

# Or tell your OpenClaw agent:
# "Pair with NervePay using code ABC123"

# The dashboard auto-detects completion and the gateway appears in your list.

# 1. Open NervePay Dashboard > Integrations > Connect Gateway > "Auto Pair" tab
# 2. Enter your gateway URL (e.g. http://localhost:18789)
# 3. Click "Start Pairing"

# NervePay connects to your gateway via WebSocket and requests pairing.
# You'll see a request ID and the approval command in the dashboard.

# 4. On your gateway machine, approve the request:
openclaw devices approve <requestId>

# The dashboard auto-detects approval and the gateway appears in your list.

# If you prefer manual setup, you can enter details directly.

# 1. Find your gateway token:
cat ~/.openclaw/openclaw.json
# Look for the "auth" or "token" field

# 2. In NervePay Dashboard > Integrations > Connect Gateway > "Enter Details" tab:
#    - Gateway Name: e.g. "My Dev Machine"
#    - Gateway URL: e.g. http://localhost:18789
#    - Gateway Token: (paste from openclaw.json)

# 3. Click "Connect Gateway"

# ─── Step 1: Enable Funnel in your Tailscale ACL policy ─────────────
# Funnel requires an ACL grant. Without it, "tailscale funnel" silently
# falls back to Serve (tailnet-only) and your gateway won't be reachable
# from the internet.
#
# Go to: https://login.tailscale.com/admin/acls/file
#
# Add this to your ACL JSON (or merge with existing nodeAttrs):

{
  "nodeAttrs": [
    {
      "target": ["autogroup:member"],
      "attr":   ["funnel"]
    }
  ]
}

# This allows all members of your tailnet to use Funnel.
# You can also restrict to specific nodes:
#   "target": ["tag:server"]  or  "target": ["user@example.com"]

# ─── Step 2: Reset any existing serve config and enable Funnel ──────
# If you see "listener already exists for port 443", clear existing config:
tailscale serve reset

# Now enable Funnel for your OpenClaw gateway port:
tailscale funnel 18789

# Expected output:
#   Available on the internet:
#   https://my-machine.tail1234.ts.net/
#   |-- / proxy http://127.0.0.1:18789
#
# ⚠️  If it says "(tailnet only)" instead of "Available on the internet",
#     Funnel is NOT enabled — go back to Step 1 and check your ACL policy.

# Use this URL in the NervePay dashboard:
#    Gateway URL: https://my-machine.tail1234.ts.net

# Tailscale terminates TLS — your gateway receives plain HTTP locally.

# Verify Funnel is on (not just Serve):
tailscale funnel status

# ✅ Correct (Funnel working):
#   https://my-machine.tail1234.ts.net/
#   |-- / proxy http://127.0.0.1:18789
#   (with NO "tailnet only" label)

# ❌ Wrong (Serve only, not Funnel):
#   https://my-machine.tail1234.ts.net (tailnet only)
#   |-- / proxy http://127.0.0.1:18789
#   → Fix: enable Funnel in ACL policy (Step 1)

# Test from any machine NOT on your tailnet:
curl https://my-machine.tail1234.ts.net/health

# From the NervePay dashboard:
# Integrations > OpenClaw > expand gateways > click refresh icon

# Or check directly from your terminal:
openclaw gateway status

# Expected output:
# Gateway running on :18789
# Nodes: 1 connected
# Uptime: 2h 15m

# After connecting a gateway, you can spawn sub-agents from Mission Control:

# Via Dashboard:
# Mission Control > Sub-Agents > "Spawn Agent"
# - Select gateway
# - Enter task description
# - Choose model (optional)
# - Click "Spawn"

# The agent runs on your OpenClaw gateway and reports back to NervePay.

# Connection refused
# → Ensure your gateway is running: openclaw gateway start
# → Check the port: default is 18789
# → If behind a firewall, ensure the port is accessible

# Pairing timed out
# → You have 5 minutes to approve after starting pairing
# → Run: openclaw devices list   (to see pending requests)
# → Run: openclaw devices approve <requestId>

# Gateway shows "unhealthy"
# → Click the refresh icon to re-check health
# → Verify the gateway process is still running
# → Check gateway logs: openclaw gateway logs

# Token expired / invalid
# → Disconnect and reconnect the gateway
# → Or use Auto Pair to get a fresh token automatically

# Tailscale: connection refused / timeout
# → Verify both machines are on the same tailnet: tailscale status
# → Test reachability: curl http://<tailscale-ip>:18789/health
# → If using Funnel, ensure it's still running: tailscale funnel status
# → Check that Tailscale ACLs allow traffic on port 18789