Neura Market Logo

openclaw configure: Interactive CLI Configuration Wizard

Reference for the openclaw configure command, which launches interactive prompts to adjust credentials, devices, agents, gateway, channels, plugins, skills, and health checks. Intended for users who need targeted configuration changes without running the full setup.

Read this when

  • You want to tweak credentials, devices, or agent defaults interactively

openclaw configure

Use interactive prompts to make targeted adjustments to an existing configuration: credentials, devices, agent defaults, gateway, channels, plugins, skills, and health checks.

Run openclaw onboard or openclaw setup for the complete guided first-run experience, openclaw setup --baseline for just the baseline config or workspace, and openclaw channels add when only channel account setup is required.

Tip

Calling openclaw config without any subcommand launches the same wizard. For non-interactive edits, use openclaw config get|set|unset.

Options

--section <section>: a repeatable section filter. The following sections are available:

workspace, model, web, gateway, daemon, channels, plugins, skills, health

openclaw configure
openclaw configure --section web
openclaw configure --section model --section channels
openclaw configure --section gateway --section daemon

Choosing gateway, daemon, or health (or starting the full wizard without --section) triggers a prompt for where the Gateway runs and updates gateway.mode. When all three are skipped by the section filter, the requested setup proceeds directly without a gateway-mode prompt. Selecting remote gateway mode writes the remote configuration and exits immediately; local-only steps such as plugin installations are skipped.

Note

An interactive terminal is required for openclaw configure (both stdin and stdout must be TTYs). Without one, the equivalent non-interactive openclaw config get|set|patch|validate commands are printed and the process exits with an error, rather than running partially.

Model section

Note

Model offers a multi-select for the explicit agents.defaults.modelPolicy.allow list (which appears in /model and the model picker). Provider-scoped setup choices merge their selected models into the existing list without replacing unrelated providers already present in the config. Per-model aliases and parameters stay under agents.defaults.models; those entries do not independently restrict model overrides.

Re-running provider auth from configure preserves an existing agents.defaults.model.primary, even when the provider's auth step returns a config patch containing its own recommended default model. Adding or reauthenticating a provider makes its models available without overriding your current primary model. To intentionally change the default model, use openclaw models auth login --provider <id> --set-default or openclaw models set <model>.

When configure starts from a provider auth choice, the default-model and model-policy pickers automatically prefer that provider. For paired providers like Volcengine and BytePlus, the same preference also applies to their coding-plan variants (volcengine-plan/*, byteplus-plan/*). If the preferred-provider filter would result in an empty list, configure falls back to the unfiltered catalog instead of displaying a blank picker.

Web section

openclaw configure --section web selects a web-search provider and sets up its credentials. Some providers display provider-specific follow-up steps:

  • Grok may offer optional x_search setup using the same xAI OAuth profile or API key, and let you choose an x_search model.
  • Kimi may ask for the Moonshot API region (api.moonshot.ai versus api.moonshot.cn) and the default Kimi web-search model.

Other notes

  • After local config is written, configure installs selected downloadable plugins if the chosen setup path requires them. Remote gateway configuration does not install local plugin packages.
  • Channel-oriented services (Slack/Discord/Matrix/Microsoft Teams) prompt for channel or room allowlists during setup. Names or IDs can be entered; the wizard resolves names to IDs when possible.
  • If the daemon install step is run, token auth requires a token. When gateway.auth.token is managed by SecretRef, configure validates the SecretRef but does not store resolved plaintext token values in supervisor service environment metadata; if the SecretRef is unresolved, configure blocks daemon install and provides actionable remediation guidance.
  • If both gateway.auth.token and gateway.auth.password are configured and gateway.auth.mode is unset, configure blocks daemon install until the mode is explicitly set.