Quick Start Guide

Get OpenClaw with ArmorClaw security plugin running in under 5 minutes with our automated installer.

One Command Installation

The ArmorClaw installer handles everything: cloning and building OpenClaw, installing the plugin, signing you in to ArmorIQ, configuring your LLM and Telegram bot, and writing production-ready config - all in one interactive flow.

Prerequisites

Supported OS: macOS, Linux, or Windows (use Git Bash or WSL on Windows)
Node.js in a range OpenClaw supports: >=22.22.3 <23, >=24.15.0 <25, or >=25.9.0. Node 23.x and 24.0 to 24.14 and 25.0 to 25.8 are not supported. The installer checks this before doing any work and tells you what to install.
pnpm and Git (installer will check and guide you)
An LLM API key - OpenAI (sk-...), Google Gemini, OpenRouter (sk-or-...), or Anthropic
An ArmorIQ account. No key needed up front: the installer opens a browser for you to approve, then saves the key it mints.
Optional: Telegram bot token for chat interface

Setup Steps

Install with One Command

Run the ArmorClaw installer:

curl -fsSL https://armoriq.ai/install-armorclaw.sh | bash

curl -fsSL https://armoriq.ai/install-armorclaw.sh | bash

Run from Git Bash (or WSL), not plain CMD/PowerShell.

The installer runs 6 stages with interactive prompts:

    ╔════════════════════════════════════════════════════════════╗
    ║                                                            ║
    ║     ▄▀█ █▀█ █▀▄▀█ █▀█ █▀█ █▀▀ █   ▄▀█ █ █ █                ║
    ║     █▀█ █▀▄ █ ▀ █ █▄█ █▀▄ █▄▄ █▄▄ █▀█ ▀▄▀▄▀                ║
    ║                                                            ║
    ║      AI agents are moving fast. Security isn't.            ║
    ║                                                            ║
    ║      The control layer for the agent era.                  ║
    ║      Track intent. Catch drift. Stop risk.                 ║
    ║                                                            ║
    ║                   armoriq.ai                               ║
    ║                                                            ║
    ╚════════════════════════════════════════════════════════════╝

[1/6] Preparing environment
✓ Git 2.53.0
✓ pnpm 10.32.1

[2/6] Cloning OpenClaw v2026.7.1
✓ Cloned OpenClaw v2026.7.1

[3/6] Building OpenClaw
✓ Dependencies installed
✓ Build complete
✓ Control UI built

[4/6] Setting up ArmorClaw
✓ ArmorClaw plugin installed from npm
✓ armoriq CLI ready

[5/6] Configuring channels and agent
  → Telegram bot setup (token, DM policy, stream mode)
  → LLM provider selection and API key
  → ArmorIQ sign-in (browser approval)

[6/6] Writing configuration
✓ openclaw.json configured
✓ .env annotated (no endpoints pinned)

What the installer sets up automatically:

Clones and builds the pinned OpenClaw release, including the Control UI
Installs and enables the @armoriq/armorclaw npm plugin
Installs the armoriq CLI so you have login / whoami / logout
Signs you in to ArmorIQ via browser approval and saves the key to ~/.armoriq/credentials.json
Writes ~/.openclaw/openclaw.json and your LLM API keys to ~/.openclaw/auth-profiles.json

No ArmorIQ endpoints are written anywhere. The plugin derives them from ARMORIQ_ENV, so there is nothing to keep in sync when a service moves.

If OpenClaw is already installed, the installer checks the existing version. At the pinned version it leaves the clone alone. At a different version it fetches the target tag and checks it out in place, keeping your .env, node_modules and any local edits, and rebuilds (the previous build belongs to the old version). It only falls back to a fresh clone if that update fails, and your .env is restored afterwards either way.

Installation complete! OpenClaw is installed at ~/openclaw-armoriq with ArmorClaw fully configured.

Interactive Prompts During Install

The installer walks you through three interactive setup sections during Stage 5.

Telegram Bot (optional)

❯ Set up Telegram bot?
  > Yes, I have a bot token
    No, skip for now

If you choose yes, you'll be asked:

Bot token - paste the token from @BotFather
DM policy - who can message the bot:
- open - anyone can DM (recommended for personal use)
- pairing - new users must enter a pairing code
- allowlist - only explicitly allowed user IDs
Stream mode - how replies appear in DMs:
- partial - stream partial text as it generates (recommended)
- block - send chunked complete messages
- off - disable streaming

To get a Telegram bot token:

Open Telegram and message @BotFather
Send /newbot and follow the prompts
Copy the token (format: 1234567890:ABCdef...)

LLM Provider

❯ Select primary LLM provider
  > OpenAI GPT (gpt-5.2)
    Google Gemini (gemini-2.5-flash)
    OpenRouter (any model)
    Custom model ID

Provider	Key format	Where to get it
OpenAI	`sk-...`	platform.openai.com/api-keys
Google Gemini	`AIza...`	aistudio.google.com/apikey
OpenRouter	`sk-or-...`	openrouter.ai/keys
Custom	any model ID	e.g. `anthropic/claude-4` via OpenRouter

The installer saves your key directly into ~/.openclaw/auth-profiles.json - no manual .env edits needed for the LLM key.

Connect to ArmorIQ

No key to paste. The installer opens your browser and waits for you to approve:

  1. Opening ArmorIQ, authorize ArmorClaw in your browser.
  2. Confirm the code UTF5-Z65Y matches, then approve.

  Approval link:
  https://platform.armoriq.ai/auth/device?code=UTF5-Z65Y&product=armorclaw

· Waiting for approval (Ctrl-C to skip)...
✓ ArmorIQ connected as you@example.com
·   Key ak_live...d4a6 saved to ~/.armoriq/credentials.json

If the browser cannot open, the link is printed in full to copy. If the approval flow fails entirely, the installer falls back to the dashboard at tools.armoriq.ai and accepts a pasted key.

All prompts can be skipped. To connect later run armoriq login, or set ARMORIQ_API_KEY in your environment.

Verify Configuration (Manual / Review)

The installer writes everything for you. To review or adjust your config:

cat ~/.openclaw/openclaw.json

A complete auto-generated config looks like this:

{
  "auth": {
    "profiles": {
      "openai:default": {
        "provider": "openai",
        "mode": "api_key"
      }
    },
    "order": {
      "openai": ["openai:default"]
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "openai/gpt-5.2"
      }
    }
  },
  "channels": {
    "telegram": {
      "enabled": true,
      "botToken": "YOUR_BOT_TOKEN",
      "dmPolicy": "open",
      "allowFrom": ["*"],
      "groupPolicy": "allowlist",
      "streamMode": "partial"
    }
  },
  "gateway": {
    "mode": "local"
  },
  "plugins": {
    "enabled": true,
    "allow": ["armorclaw", "telegram"],
    "entries": {
      "telegram": { "enabled": true },
      "armorclaw": {
        "enabled": true,
        "config": {
          "enabled": true,
          "policyUpdateEnabled": true,
          "policyUpdateAllowList": ["*"],
          "userId": "you@example.com",
          "agentId": "openclaw-agent-001",
          "contextId": "default",
          "policyStorePath": "~/.openclaw/armoriq.policy.json"
        }
      }
    }
  },
  "messages": {
    "ackReactionScope": "group-mentions"
  }
}

Common values to customise:

agents.defaults.model.primary - change provider/model (e.g. google/gemini-2.5-flash, openrouter/auto)
armorclaw.config.userId - your user identifier
armorclaw.config.agentId - unique agent name
armorclaw.config.policyUpdateAllowList - IDs authorised to manage policies via chat

Important: Include "agent:main:main" and "main" in policyUpdateAllowList as fallback identities for when Telegram does not pass sender info.

LLM API keys are stored separately in ~/.openclaw/auth-profiles.json (written by the installer). Do not put them in openclaw.json.

Start OpenClaw Gateway

That's it! Start the gateway:

cd ~/openclaw-armoriq
pnpm dev gateway

Expected output:

[plugins] IAP Verification Service initialized - Base URL: https://api.armoriq.ai
[plugins] CSRG Verification URL: https://iap.armoriq.ai
[plugins] CSRG proof headers are REQUIRED for tool execution

🦞 OpenClaw 2026.7.1

[gateway] agent model: openai/gpt-5.2
[gateway] listening on ws://127.0.0.1:18789
[telegram] starting provider (@your_bot)

Gateway is running!

ArmorClaw plugin loaded
Production endpoints configured
Intent verification active
Telegram connected (if configured)

Leave this terminal open.

What to look for:

"IAP Verification Service initialized" with production URL
"CSRG Verification URL" with production endpoint
NO "Missing model context" errors
Telegram provider starts (if bot token configured)

Test Your Bot

Open your messaging app and message your bot. Try these commands:

Using Slack, Discord, or WhatsApp? Message your bot on that platform with the same commands below.

Test 1: Basic command

Policy help

Expected: List of policy management commands.

Test 2: List policies

Policy list

Expected: "No policies defined" (fresh setup).

Test 3: Create a policy

Policy new: block exec commands

Expected: Policy created with ID and priority.

Test 4: Regular task

What is the weather in San Francisco?

Bot should search the web and respond.

Check logs (in another terminal):

tail -f /tmp/openclaw/openclaw-*.log | grep -i armorclaw

You should see:

[plugins] armorclaw: [agent_start] sessionKey=agent:main:main
Intent token issued: id=..., expires=60.0s
[plugins] armorclaw: [tool_call] tool=web_search allowed=true

Verification

Your setup is complete when:

Gateway shows "listening on ws://127.0.0.1:18789"
Your bot responds to messages
Logs show "Intent token issued"
Policy commands work without "denied" errors
Dashboard at platform.armoriq.ai shows executions

Directory Structure

After installation, your setup looks like this:

~/openclaw-armoriq/              # OpenClaw installation
├── dist/                        # Built gateway
├── src/                         # Patched source files
├── .env                         # ArmorIQ endpoints
└── package.json

~/.openclaw/                     # OpenClaw config directory
├── openclaw.json                # Main config (model, channels, plugin)
├── auth-profiles.json           # LLM API keys (written by installer)
├── armoriq.policy.json          # Policy store
└── extensions/
    └── armorclaw/               # Installed ArmorClaw plugin

Key files:

~/openclaw-armoriq/.env - ArmorIQ endpoint environment variables
~/.openclaw/openclaw.json - OpenClaw main configuration
~/.openclaw/auth-profiles.json - Encrypted LLM API keys (do not edit manually)
~/.openclaw/armoriq.policy.json - Active security policies

Non-Interactive / CI Usage

Pass everything via flags to skip all prompts:

curl -fsSL https://armoriq.ai/install-armorclaw.sh | bash -s -- \
  --api-key ak_live_YOUR_KEY \
  --openai-key sk-YOUR_OPENAI_KEY \
  --model openai/gpt-5.2 \
  --telegram-token YOUR_BOT_TOKEN \
  --telegram-dm-policy open \
  --telegram-stream partial

Available flags:

Flag	Description
`--api-key`	ArmorIQ API key
`--openai-key`	OpenAI API key
`--gemini-key`	Google Gemini API key
`--openrouter-key`	OpenRouter API key
`--anthropic-key`	Anthropic API key
`--model`	Model ID (e.g. `google/gemini-2.5-flash`, `openrouter/auto`)
`--telegram-token`	Telegram bot token
`--telegram-dm-policy`	`open` / `pairing` / `allowlist`
`--telegram-stream`	`partial` / `block` / `off`
`--install-dir`	Override install directory (default: `~/openclaw-armoriq`)
`--no-prompt`	Disable all interactive prompts (CI mode)
`--skip-build`	Skip the build step (faster re-installs)
`--dry-run`	Show plan without installing

Troubleshooting

Gateway won't start

Check Node.js version:

node --version  # Should be v22+

Check dependencies installed:

cd ~/openclaw-armoriq
pnpm install

Check build completed:

ls ~/openclaw-armoriq/dist/entry.js  # Should exist

"openclaw: command not found"

Use the full path:

cd ~/openclaw-armoriq
pnpm dev gateway

Plugin not loading

Verify plugin installed:

openclaw plugins list   # look for: ArmorClaw ... enabled

Ask OpenClaw rather than looking for a directory. The install location has moved between releases: 2026.4.x unpacked into ~/.openclaw/extensions/armorclaw, while 2026.7.x installs into ~/.openclaw/npm/projects/<hash>/. It also keeps older "generation" directories around, so the newest one on disk is the one in use and an old directory does not mean an old plugin.

Check OpenClaw config:

cat ~/.openclaw/openclaw.json | grep -A3 armorclaw

"policy_update denied"

Cause: Your user ID not in allowList.

Fix: Add "agent:main:main" and "main" to policyUpdateAllowList in config.

"ArmorIQ API key missing"

Cause: Not signed in, so the plugin has no key to work with. It fails closed and blocks tool calls rather than running unprotected.

Fix: Sign in. The key lands in ~/.armoriq/credentials.json and the plugin picks it up from there.

armoriq login
armoriq whoami                    # confirm the signed-in account
cat ~/.armoriq/credentials.json   # should contain an "apiKey" starting with ak_

You do not need to set endpoints. They are derived from ARMORIQ_ENV, which defaults to production. Set ARMORIQ_API_KEY only if you want to override the signed-in key.

Bot not responding

For Telegram:

curl https://api.telegram.org/bot<YOUR_TOKEN>/getMe

Should return bot info. If error, regenerate token with @BotFather.

For other platforms: Check your bot credentials and refer to platform-specific setup guides:

Check gateway logs:

grep -i "telegram\|slack\|discord\|whatsapp" /tmp/openclaw/openclaw-*.log | tail -20

Next Steps

Monitor Dashboard: platform.armoriq.ai - view intent executions and proofs
Add Policies: Create allow/block rules via chat
Configure Channels: Set up Telegram, Slack, Discord, or WhatsApp
Learn More: Understand Core Concepts and explore Configuration

Quick Start Guide

On this page