> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getsesame.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect a Hostinger OpenClaw to Sesame

> Route an existing Hostinger OpenClaw's egress through Sesame — survives container recreates.

Run everything below in your OpenClaw container's **App terminal** (hPanel → your app → **App terminal**), as root. The gateway runs as the `node` user (`HOME=/data`), so Sesame commands are prefixed with `runuser -u node --`. Installing into `/data` and wrapping via the compose file keeps the setup alive across restarts, reboots, and container recreates — only `/data` and the compose file survive a recreate, and both hold everything Sesame needs.

Requires the **cloud broker** at [getsesame.dev](https://getsesame.dev). See the [main OpenClaw guide](/agents/openclaw) for the concepts (secrets, injection, approvals).

## 1. Install + register (container shell)

```bash theme={null}
# install Sesame into the persistent volume, fix permissions, create the runtime dir
mkdir -p /data/.local/bin && curl -fsSL https://getsesame.dev/install.sh | sh -s -- --prefix /data/.local/bin
chown -R node:node /data/.local /data/.config
mkdir -p /run/user/1000 && chown node:node /run/user/1000 && chmod 700 /run/user/1000

# edge proxy
runuser -u node -- /data/.local/bin/sesame proxyd install

# register this device — open the printed URL in your browser and approve
runuser -u node -- /data/.local/bin/sesame login

# pre-check: must print SESAME_OK before you wrap anything
runuser -u node -- /data/.local/bin/sesame launch -- echo SESAME_OK
```

## 2. Wrap the gateway (container shell)

```bash theme={null}
cat > /data/sesame-boot.sh <<'EOF'
#!/bin/bash
set -e
chown -R node:node /data
find /data/.openclaw/agents -name '*.lock' -delete 2>/dev/null || true
mkdir -p /run/user/1000 && chown node:node /run/user/1000 && chmod 700 /run/user/1000
cd /hostinger
exec runuser -u node -- /data/.local/bin/sesame launch -- "$@"
EOF
chmod +x /data/sesame-boot.sh
```

## 3. Point the compose file at it (host shell or panel YAML editor)

In `docker-compose.yml`, under the `openclaw` service, add both keys (setting `entrypoint` clears the image's default command, so restate it):

```yaml theme={null}
    entrypoint: ["/data/sesame-boot.sh"]
    command: ["node", "server.mjs"]
```

Apply:

```bash theme={null}
cd /docker/<app> && docker compose up -d --force-recreate
```

<Warning>
  **Put these in `docker-compose.yml` itself, not `docker-compose.override.yml`.** The hPanel deploy runs `docker compose -f docker-compose.yml up -d`, which never merges an override — the container starts unwrapped, with no error.
</Warning>

## 4. Add your secrets and verify

In [getsesame.dev](https://getsesame.dev) → **Secrets → Add**, add a secret for **each host your agent calls** — the preset fills the injection mode. Set an **auto-approve policy** on your model host so chat doesn't pause every turn; keep per-call approval on side-effecting hosts.

Confirm a brokered call succeeds. Pick a host you've **confirmed has a valid secret** — the check only proves injection for that specific host:

```bash theme={null}
# hit a read-only endpoint on a brokered host; 200 means the key was injected
runuser -u node -- /data/.local/bin/sesame launch -- \
  curl -s -o /dev/null -w '%{http_code}\n' https://<host>/<read-endpoint>
```

A `401`/`403` here means the broker injected a key the host rejected — the secret for that host is missing or invalid — **not** that the wrapper is broken. Fix that host's secret, or test against a different host you know is good.

Then send a chat in OpenClaw and approve the first call. The reply arrives with your real key injected server-side — OpenClaw never sees it.

### Confirm the gateway itself is wrapped

The check above wraps a **new** `curl`, so it passes even when the running gateway is unwrapped — and `sesame status` reports registration, not mediation. Check the live process from the **host** shell:

```bash theme={null}
# 1. effective entrypoint is the boot script, not the image's default
docker inspect --format '{{.Config.Entrypoint}}' <container>

# 2. the edge proxy is actually running
docker exec <container> ps -eo args | grep sesame-proxyd

# 3. the gateway process itself carries the proxy env
docker exec -u node <container> sh -c \
  'P=$(pgrep -f "server.mjs" | tail -1); tr "\0" "\n" < /proc/$P/environ | grep -E "HTTPS_PROXY|NODE_EXTRA_CA_CERTS"'
```

Check 3 is decisive: no `HTTPS_PROXY` on the gateway's own PID means its calls bypass Sesame entirely.

## Troubleshooting

| Symptom                                                    | Fix                                                                                                                                                                                                                                                                                                                                         |
| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `sesame login` → `PermissionError: '/data/.config/sesame'` | `/data/.config` is root-owned on a fresh box. Re-run step 1's `chown -R node:node /data/.config /data/.local`, then retry.                                                                                                                                                                                                                  |
| Chat returns `{"detail":"Bad Request"}`                    | A brokered OAuth host (e.g. `chatgpt.com` via codex) is overriding the agent's own auth. Broker the host the agent actually calls and point its provider there, not the codex path.                                                                                                                                                         |
| OpenClaw is unwrapped after a change                       | A container **recreate** wipes the writable layer, but the `/data` install and compose `entrypoint` bring it back wrapped. A managed redeploy is different — see the row below.                                                                                                                                                             |
| Wrapped setup silently reverted after a panel deploy       | The hPanel deploy regenerates `docker-compose.yml` from its template, dropping your `entrypoint` and `command`. Everything in `/data` survives, so nothing looks broken. Check with `diff docker-compose.yml docker-compose.yml.bak`, re-add the keys, and run `docker compose up -d --force-recreate`. Re-verify after every panel deploy. |
| Step 4 returns `401`/`403`                                 | The wrapper is working — the host rejected its key. That host's secret is missing or invalid in **Secrets**. Re-add it, or verify against a different host you know is good.                                                                                                                                                                |

<Note>
  **Running this with an agent?** Give it the steps above and have it run them in the container's App terminal — pausing for the browser approval at `sesame login`, and confirming step 4's brokered call returns `200`.
</Note>