Michael Limberger

Configuring OpenClaw for local-only operation

This is where most people get stuck. The onboarding wizard writes a basic config, but a reliable local demo is easier when you edit the file yourself and know every field that can fail silently.

The configuration file

Main config path:

~/.openclaw/openclaw.json

Open it in your editor. Replace the relevant sections with this (or create the file if it is missing):

{
          "models": {
            "providers": {
              "ollama": {
                "baseUrl": "http://127.0.0.1:11434",
                "apiKey": "ollama-local",
                "api": "ollama",
                "models": [
                  {
                    "id": "qwen2.5-coder:14b",
                    "name": "Qwen 2.5 Coder 14B",
                    "reasoning": false,
                    "input": ["text"],
                    "cost": {
                      "input": 0,
                      "output": 0,
                      "cacheRead": 0,
                      "cacheWrite": 0
                    },
                    "contextWindow": 32768,
                    "maxTokens": 8192
                  }
                ]
              }
            }
          },
          "agents": {
            "defaults": {
              "model": {
                "primary": "ollama/qwen2.5-coder:14b"
              }
            }
          },
          "gateway": {
            "bind": "loopback",
            "port": 18789,
            "auth": {
              "mode": "token",
              "token": "REPLACE-WITH-RANDOM-TOKEN"
            }
          },
          "tools": {
            "web": {
              "search": { "enabled": false },
              "fetch": { "enabled": true }
            }
          }
        }

Generate a random gateway token:

Show me

openssl rand -hex 32

Paste that value over REPLACE-WITH-RANDOM-TOKEN.

Critical configuration details

Three fields cause most silent failures. Get them wrong and OpenClaw may simply not respond.

The api field tells OpenClaw how to talk to Ollama:

"api": "ollama"
          Uses Ollama's native /api/chat endpoint. Preferred: streaming and
          tool calling together. baseUrl must NOT end in /v1.
          Correct:   "baseUrl": "http://127.0.0.1:11434"
          Wrong:     "baseUrl": "http://127.0.0.1:11434/v1"

        "api": "openai-responses"
          Uses Ollama's OpenAI-compatible endpoint. baseUrl MUST end in /v1.
          Correct:   "baseUrl": "http://127.0.0.1:11434/v1"
          Wrong:     "baseUrl": "http://127.0.0.1:11434"

        Mixing these up causes silent failures. Prefer "ollama" with no /v1.

The reasoning field: set false for Ollama models. When true, OpenClaw may send a developer-role message Ollama does not understand.

The apiKey field: Ollama ignores it, but OpenClaw's provider init needs a non-empty string. Use ollama-local (or any placeholder).

+-----------------------------------------------------------+
|  api: "ollama"  +  baseUrl without /v1  = correct         |
|  api: "openai-responses"  +  baseUrl with /v1  = correct  |
|  Mixing them = silent failure, no error message           |
+-----------------------------------------------------------+

Environment variables

Create ~/.openclaw/.env:

OLLAMA_API_KEY=ollama-local
        OPENCLAW_DISABLE_BONJOUR=1
        OPENCLAW_GATEWAY_PORT=18789

OLLAMA_API_KEY matches the JSON placeholder. OPENCLAW_DISABLE_BONJOUR=1 stops mDNS/Bonjour discovery on the LAN (full mode can leak paths and username). OPENCLAW_GATEWAY_PORT matches the JSON port.

Making sure no cloud keys leak in

OpenClaw's provider priority puts Ollama last:

Anthropic > OpenAI > OpenRouter > Gemini > ... > Ollama

If any cloud API key exists in the environment, OpenClaw may use that provider even when JSON points at Ollama. Check shell profiles, nearby .env files, other tools, and occasionally Keychain.

env | grep -i "anthropic\|openai\|openrouter\|gemini"

That should return nothing. After a test message, watch logs:

Show me

openclaw logs --follow

Look for anthropic, openai, or other cloud names. There is a known issue (GitHub #5790) where some versions fall back to Anthropic even when no key seems present.

Show me

openclaw models list

You should see only your Ollama model. Cloud models in that list mean the config is wrong.

File permissions

Lock down the config directory before you continue:

chmod 700 ~/.openclaw
        chmod 600 ~/.openclaw/openclaw.json
        chmod 600 ~/.openclaw/.env

That directory holds the gateway token, transcripts, and possibly OAuth tokens in plaintext JSON and Markdown.

Also check legacy dirs from earlier project names (ClawDBot / MoltBot):

ls -la ~/.clawdbot/ ~/.moltbot/ 2>/dev/null

If they exist, secure or delete old credentials. Configuration is done. Security hardening is next, and it is not optional.