Connect a Hostinger OpenClaw to Sesame

Run everything below in your OpenClaw container’s App terminal (hPanel → your app → App terminal), as root. The gateway runs as the node user (HOME=/data), so Sesame commands are prefixed with runuser -u node --. Installing into /data and wrapping via the compose file keeps the setup alive across restarts, reboots, and container recreates — only /data and the compose file survive a recreate, and both hold everything Sesame needs. Requires the cloud broker at getsesame.dev. See the main OpenClaw guide for the concepts (secrets, injection, approvals).

1. Install + register (container shell)

# install Sesame into the persistent volume, fix permissions, create the runtime dir
mkdir -p /data/.local/bin && curl -fsSL https://getsesame.dev/install.sh | sh -s -- --prefix /data/.local/bin
chown -R node:node /data/.local /data/.config
mkdir -p /run/user/1000 && chown node:node /run/user/1000 && chmod 700 /run/user/1000

# edge proxy
runuser -u node -- /data/.local/bin/sesame proxyd install

# register this device — open the printed URL in your browser and approve
runuser -u node -- /data/.local/bin/sesame login

# pre-check: must print SESAME_OK before you wrap anything
runuser -u node -- /data/.local/bin/sesame launch -- echo SESAME_OK

2. Wrap the gateway (container shell)

cat > /data/sesame-boot.sh <<'EOF'
#!/bin/bash
set -e
chown -R node:node /data
find /data/.openclaw/agents -name '*.lock' -delete 2>/dev/null || true
mkdir -p /run/user/1000 && chown node:node /run/user/1000 && chmod 700 /run/user/1000
cd /hostinger
exec runuser -u node -- /data/.local/bin/sesame launch -- "$@"
EOF
chmod +x /data/sesame-boot.sh

3. Point the compose file at it (host shell or panel YAML editor)

In docker-compose.yml, under the openclaw service, add both keys (setting entrypoint clears the image’s default command, so restate it):

    entrypoint: ["/data/sesame-boot.sh"]
    command: ["node", "server.mjs"]

Apply:

cd /docker/<app> && docker compose up -d --force-recreate

4. Add your secrets and verify

In getsesame.dev → Secrets → Add, add a secret for each host your agent calls — the preset fills the injection mode. Set an auto-approve policy on your model host so chat doesn’t pause every turn; keep per-call approval on side-effecting hosts. Confirm a brokered call succeeds, using any host you added a secret for:

# hit a read-only endpoint on a brokered host; 200 means the key was injected
runuser -u node -- /data/.local/bin/sesame launch -- \
  curl -s -o /dev/null -w '%{http_code}\n' https://<host>/<read-endpoint>

Then send a chat in OpenClaw and approve the first call. The reply arrives with your real key injected server-side — OpenClaw never sees it.

Troubleshooting

Symptom	Fix
`sesame login` → `PermissionError: '/data/.config/sesame'`	`/data/.config` is root-owned on a fresh box. Re-run step 1’s `chown -R node:node /data/.config /data/.local`, then retry.
Chat returns `{"detail":"Bad Request"}`	A brokered OAuth host (e.g. `chatgpt.com` via codex) is overriding the agent’s own auth. Broker the host the agent actually calls and point its provider there, not the codex path.
OpenClaw is unwrapped after a change	A container recreate (a panel env-var edit, an image pull) wipes the container’s writable layer — but the `/data` install + compose `entrypoint` above bring it back up wrapped on their own. Re-confirm with step 4.

Running this with an agent? Give it the steps above and have it run them in the container’s App terminal — pausing for the browser approval at sesame login, and confirming step 4’s brokered call returns 200.

Get Started

CLI Reference

Agent Skills

Connect an Agent

Security & Privacy

Integrations

Connect a Hostinger OpenClaw to Sesame

1. Install + register (container shell)

2. Wrap the gateway (container shell)

3. Point the compose file at it (host shell or panel YAML editor)

4. Add your secrets and verify

Troubleshooting

​1. Install + register (container shell)

​2. Wrap the gateway (container shell)

​3. Point the compose file at it (host shell or panel YAML editor)

​4. Add your secrets and verify

​Troubleshooting

1. Install + register (container shell)

2. Wrap the gateway (container shell)

3. Point the compose file at it (host shell or panel YAML editor)

4. Add your secrets and verify

Troubleshooting