Neura Market Logo

openclaw dashboard CLI Reference: Launch the Control UI

This page covers the openclaw dashboard command for launching the Control UI. It is intended for users who need to start the UI with authentication credentials or use machine-readable output.

Read this when

  • You want to open the Control UI with your current token
  • You want to print the URL without launching a browser

openclaw dashboard

Launch the Control UI with your existing authentication credentials.

openclaw dashboard
openclaw dashboard --no-open
openclaw dashboard --json
openclaw dashboard --yes
  • --no-open: display the URL without starting a browser.
  • --json: output a single machine-readable connection object without launching a browser, using the clipboard, showing a prompt, or starting the Gateway.
  • --yes: install or start the Gateway without asking for permission when necessary.

Machine-readable output

For desktop integrations and scripts that require the resolved Control UI URL, use --json:

openclaw dashboard --json

The response contains url, httpUrl, wsUrl, port, and tokenIncluded. When the Gateway is not ready, the command returns {"ok":false,"reason":"..."} and exits with a non-zero status. Tokens managed through SecretRef are never included in url.

Notes:

  • Where possible, resolves configured gateway.auth.token SecretRefs.
  • Respects gateway.tls.enabled: TLS-enabled gateways display or open https:// Control UI URLs and communicate over wss://.
  • For lan or a wildcard custom bind, same-host launches always fall back to loopback because a wildcard is not a valid browser destination. Plaintext tailnet and custom binds also use 127.0.0.1 to give the browser a secure context; TLS-enabled specific hosts retain the configured address so certificate names remain valid.
  • Before delivering an authenticated loopback URL for a specific-interface bind, the command tests the configured interface and confirms that it and 127.0.0.1 belong to the same Gateway process. If listener ownership is ambiguous, the command fails closed with status guidance.
  • For SecretRef-managed tokens (whether resolved or unresolved), the displayed, copied, or opened URL never contains the token, preventing external secrets from appearing in terminal output, clipboard history, or browser-launch arguments.
  • When gateway.auth.token is managed by a SecretRef but unresolved, the command outputs a URL without a token along with remediation guidance, rather than an invalid token placeholder.
  • If clipboard or browser delivery fails for a token-authenticated URL, the command logs a safe manual-authentication hint that mentions OPENCLAW_GATEWAY_TOKEN, gateway.auth.token, and the URL fragment key token, without exposing the token value.