Blog

OpenClaw “origin not allowed” fix

The OpenClaw Control UI loads but shows origin not allowed (open the Control UI from the gateway host or allow it in gateway.controlUi.allowedOrigins) because the browser origin you opened it from isn't in the gateway's allowlist. Fix it by adding the exact origin your browser shows — scheme, host, and port — to the gateway's controlUi.allowedOrigins allowlist, then restarting the gateway. It usually appears after moving from a local to a public deployment through FRP / Nginx / Caddy or IP forwarding.

What to put in the allowlist

Use the exact origin the browser sends — scheme://host:port, matched character for character: 

{ "gateway": { "controlUi": { "allowedOrigins": ["https://agent.example.com"] } } }
  • Behind a TLS-terminating proxy (Nginx / Caddy / Cloudflare): use the public https:// origin and the port the browser sees (e.g. https://agent.example.com, no :18789) — not the gateway's internal http address.
  • Docker / Kubernetes: set it by env var — OPENCLAW_GATEWAY_CONTROLUI_ALLOWEDORIGINS='["https://agent.example.com"]' (a JSON-array string).
  • List every host you'll actually use; avoid ["*"] outside tightly controlled local testing.

If the gateway won't start at all (non-loopback Control UI requires gateway.controlUi.allowedOrigins), that's the startup variant — see the OpenClaw non-loopback startup fix.

Recent reports
  • GitHub issue #29809 created 2026-02-28, updated 2026-03-01 with reproducible cloud + FRP setup.
  • Multiple teams reporting "page reachable but Control UI blocked" pattern after moving from local to public deployment.

Actionable fix sequence

  1. Choose one canonical UI URL (for example: https://agent.example.com).
  2. Add exact origin allowlist in ~/.openclaw/openclaw.json: 
    {
  "gateway": {
    "controlUi": {
      "allowedOrigins": ["https://agent.example.com"]
    }
  }
}
  3. Restart gateway: openclaw gateway restart.
  4. Proxy hygiene: make sure your reverse proxy forwards Host and X-Forwarded-Proto consistently.
  5. Retest in incognito to avoid stale browser cache/token state.

What usually causes repeated failures

  • Mixing IP and domain access (e.g., open by IP once, domain next).
  • Allowing the wrong scheme (http vs https mismatch).
  • Changing forwarded host in FRP/Nginx while keeping old origin list.
  • Using wildcard origins in one layer while another layer enforces strict host checks.

Stop babysitting your OpenClaw box

Fix it once — or stop fixing it for good.

Apply the checklist above and keep self-hosting, or skip the maintenance entirely: run your OpenClaw on managed hosting from $6.90/mo, starting with a 7-day free trial. We handle the stale locks, gateway restarts, version upgrades, and uptime — and you can import your existing instance in a couple of minutes. Cancel anytime.

Managed hosting — from $6.90/mo Your own hosted OpenClaw instance with automatic restarts and version upgrades. Starts with a 7-day free trial — import your current setup, keep your channels, cancel anytime.
$199 managed setup — optional Prefer we do it for you? One workspace configured end-to-end: first-run config, one 30-minute onboarding/debug session, and a 7-day follow-up. Limited weekly slots.
  • Managed hosting handles stale .jsonl.lock files, gateway restarts, and version upgrades for you
  • Import your existing OpenClaw setup in minutes — keep your channels and configuration
  • The optional $199 setup is scoped: no custom development, enterprise/SRE support, or unsupported self-hosting repair

If you would rather compare options first, review OpenClaw cloud hosting or see the best OpenClaw hosting options before deciding.

OpenClaw import first screen in OpenClaw Setup dashboard (light theme) OpenClaw import first screen in OpenClaw Setup dashboard (dark theme)
1) Paste import payload
OpenClaw import completed screen in OpenClaw Setup dashboard (light theme) OpenClaw import completed screen in OpenClaw Setup dashboard (dark theme)
2) Review and launch
When this issue keeps returning, switch to a more stable setup

If you're already updating gateway and browser config, this is a good time to move to managed hosting: keep your instance updated and use Chrome Extension relay for real local browser tab control.

See OpenClaw cloud hosting See Chrome Extension feature

For a broader decision view, compare managed hosting vs self-hosted VPS or review the best OpenClaw hosting options.

FAQ

What do I set gateway.controlUi.allowedOrigins to?

The exact origin your browser shows in the address bar — scheme, host, and port (for example https://agent.example.com). Behind a TLS-terminating reverse proxy, use the public https origin and the port the browser sees, not the gateway's internal http address or port.

Can I keep both IP and domain allowed?

Yes, but only if both are intentional. Keep the list explicit and minimal.

Why did it work locally but fail in cloud?

Cloud and proxy setups introduce browser-origin differences that local loopback deployments don’t have.

Sources

Cookie preferences