Connect your own OpenClaw instance (BYOI)

OpenClaw is the underlying agent runtime. If you run your own instance (your VPS, Kubernetes, anywhere reachable over HTTPS), you can plug it into ORYKSA AI without going through dashboard.oryksa.com.

What your server needs to expose

Your OpenClaw manager must expose two HTTPS endpoints:

• POST /api/whatsapp/incoming: receives signed inbound messages from ORYKSA AI.
• It must POST replies back to https://app.oryksa.com/api/whatsapp/outgoing with the same HMAC-SHA256 signature using the shared webhook_secret.

Headers used (both directions):

• X-ORYKSA-Signature (incoming) / X-OpenORYKSA-Signature (outgoing): hex-encoded HMAC-SHA256 of the raw body.
• X-ORYKSA-Tenant / X-OpenORYKSA-Tenant: oryksa-tenant-{user-id}.
• X-ORYKSA-Timestamp / X-OpenORYKSA-Timestamp: unix seconds (replays older than 5 min are rejected).

Steps

1. In ORYKSA AI go to Connectors → OpenClaw.
2. Fill in:
   - Manager URL: your HTTPS URL (e.g. https://my-claw.example.com).
   - Webhook secret: at least 16 characters; use the same value on both sides.
   - Agent ID: the agent name on your manager (free-form string).
   - Owner WhatsApp (optional): your own number, gets full agent privileges.
3. Click Connect.

Per-contact opt-in

Same panel as the OpenORYKSA connector: paste WhatsApp numbers in Contacts answered by your OpenClaw to opt them in. Anyone else stays on ORYKSA AI's default agent.

Networking notes

• The endpoint must be reachable from app.oryksa.com. Cloudflare Tunnel or a public Traefik with a real cert work fine.
• We never make outbound calls to private IPs (SSRF-protected): use a public hostname.